Privacy

Last updated July 25, 2026.

Short version: Heatwave does not run an anonymous advertising beacon or create a persistent anonymous visitor ID. Creator and campaign details from a tagged link may be kept in first-party browser storage for up to 30 days so a later signup or purchase can be credited correctly.

Information Heatwave uses

Account details you provide through Firebase Authentication, such as name and email.
Trial, entitlement, promo, and private-deck data needed to operate your account.
Referral and campaign fields included in a tagged link, plus the landing URL and capture time.
Authoritative Stripe Checkout and webhook records needed to confirm a one-time purchase.

Referral attribution

Tagged creator, creator-link token, and UTM details are stored by Heatwave in your browser for up to 30 days. Untagged visits do not create acquisition storage, and ordinary untagged navigation does not replace a stored first touch. Expired attribution is removed the next time Heatwave runs in that browser. If you sign up or open Checkout, campaign details are sanitized again on the server. Commission is calculated only from a signed Stripe webhook and an active creator record whose server-issued link token matches. Browser claims do not create payment status or commission by themselves.

Payments

Stripe processes card details. Heatwave does not receive or store your full card number. Heatwave stores an immutable purchase ledger containing the Checkout Session and Payment Intent identifiers, purchase amount, currency, payment lifecycle, entitlement state, and sanitized attribution required for reconciliation, refunds, disputes, and fraud prevention.

Operational notifications

When you create an account or complete an unlock, Heatwave sends the owner an operational alert containing account and purchase details such as your name, email, authentication provider, marketing preference, campaign attribution, and transaction identifier. These alerts are delivered through Resend or, if needed, FormSubmit. They are required to operate and secure the service and are sent regardless of marketing consent. Marketing consent controls promotional messages, not transactional or security notices.

Account deletion

The account menu includes Delete account. It removes the Firebase Authentication account, Heatwave profile, private decks, redemptions, linked operational notifications, and local attribution storage. Heatwave retains purchase and Checkout records in pseudonymized form, without the account UID or creator-link token, when needed for financial reconciliation, refunds, disputes, fraud prevention, and legal obligations. Stripe and email providers may retain transaction or delivery records under their own legal and security obligations. For deletion or privacy questions, email privacy@playheatwave.com.

Private play

Images imported from your device remain in that browser unless you deliberately use an admin publishing feature. Heatwave is intended for consenting adults aged 21 and over.

Changes

This notice may be updated when the product or its providers change. The updated date above will change with it.