About FeedEcho

What we store

• Your account: email address and a salted scrypt hash of your password. Passwords are never stored in plain text.
• Feeds: the feed URLs you add and the last item each feed was checked against.
• Destinations: credentials for the accounts you connect — Mastodon access tokens, Bluesky app passwords, micro.blog tokens, Matrix access tokens, Discord webhook URLs, generic webhook URLs and headers, and email SMTP credentials. These are required to post on your behalf, and they are encrypted at rest.
• Post history: which items were posted where, and any delivery errors, so failures can be retried and diagnosed.

Everything lives in a Postgres database on a single VPS we operate. Data is not sold, rented, or shared with anyone.

What we don't store

• Feed content is fetched, matched against your echoes, and posted — it is not archived. Only identifiers and post outcomes are kept.
• No tracking, analytics, or advertising networks run on this service.
• No payment data is stored. Billing is handled by Stripe, which processes cards directly — card numbers never touch our servers.

Security practices

• TLS everywhere: all traffic is HTTPS with HSTS.
• Encryption at rest: destination credentials are encrypted with Fernet before they are stored.
• Sessions: signed, HttpOnly, SameSite cookies; logging out or changing your password invalidates existing sessions immediately.
• Email links: verification and password-reset tokens are single-use, expire in 24 hours, and are stored only as hashes.
• Tenant isolation: every feed, account, setting, and history row is scoped to its user at the query level.
• Post templates run in a sandboxed template engine with no filesystem or network access.
• Outbound requests (feed fetches, image downloads) are validated against SSRF patterns, including private-network ranges.
• Login protection: failed-login and signup rate limits per address; account suspension available to administrators.

Third parties

• Your connected platforms (Mastodon, Bluesky, micro.blog, Matrix, Discord, Telegram, your email provider) receive exactly the posts you configure. Nothing else.
• Billing goes through Stripe, which processes your payment card directly.
• Pages load the Inter font family from Google Fonts. No other third-party assets or requests are made from your browser.
• Server access logs record request paths (never query strings), status codes, and timestamps for operational debugging, retained briefly.

Account deletion

Deleting a feed, account, or echo from the dashboard stops it from posting and keeps its history, so your posting record stays intact. To remove everything, delete your account from Settings (password-confirmed) — that removes your account and all of its data, including post history.