Privacy Policy

Last updated October 21, 2026

This policy says what Porchlit collects, why, who processes it for us, and how you remove it. It applies to Porchlit at feed-voice.aleksiy.dev, its installed app, and its share and embed links. Porchlit is run by an independent developer ("we", "us").

The short version

We collect what the app needs to work: your account, what you add, and your listening progress.
We do not sell your data. We do not share it for advertising, and we do not use your library to train AI models.
We use no advertising or tracking cookies.
You can delete your account and its data from your profile.

What we collect

Your account

Your email address, your name if you give one, and your password.
We store a hash of your password, never the password itself.
Whether you have verified your email address.
For each signed-in session: a session cookie, plus the IP address and browser details of the device that signed in.

What you add

The articles, websites, and feeds you add, the text we extract from them, and the audio we make.
Your voice and playback settings, and the voices you favorite.
A record of each job we run for you, such as a feed check or a narration, so we can show its progress and apply fair-use limits.
The share and embed links you create.
Your email preferences, such as which feeds email you new recordings.

Private feed credentials

If you add a private feed with a username and password, a token, or a header, we encrypt that secret before we store it. The app never shows it back to you or anyone else and never writes it to logs. We decrypt it only in memory, to fetch that feed from its own site.

Listening progress

For each recording you play, we store how far you got, whether you started or finished it, and when you last played it. That is how your place follows you between devices. We also store when you first and last started playing anything.

Technical data

Server logs of requests: the page or API path, the response status, timings, and errors.
A page-speed beacon: each page reports its load and response timings, the page path, and whether it runs as an installed app. We log it with your browser's user agent and the country Cloudflare reports for the request. It does not include your account ID.
Product analytics: when you create your account, follow a feed, start playing a recording for the first time, and open the app again 7 to 13 days after you signed up, our server sends PostHog an event with your account ID. It tells us whether new listeners get to their first recording and come back. The event does not include your email address, your name, or the titles or addresses of what you add.
Error reports: when the app hits an error, it sends us the type of error, a short message with any web or email addresses removed, where in our code it happened, and the page path. We forward the report to PostHog with your account ID if you are signed in, or with a random ID that lasts until you close the tab if you are not.

On your device

The app keeps a sign-in cookie, and stores downloaded audio and cached data in your browser so you can listen offline. Clearing your browser data removes them.

How we use it

To run Porchlit: fetch articles, make audio, and sync your progress.
To send account email: email verification, password resets, and the emails about new recordings you turn on for a feed.
To apply fair-use limits and keep the service safe from abuse.
To find and fix problems.

Services that process your data

These services receive data so that Porchlit can run. They process it for us, and none of them gets it for their own advertising.

Cloudflare. Runs the app and its background jobs, stores generated audio and cover images, sends account email, and keeps request logs. Everything the app handles passes through Cloudflare, including your email address, the content you add, and the audio.
Neon. Hosts our database. Your account, library, feeds, encrypted feed sign-ins, listening progress, and share links.
DeepInfra. Makes the speech for every article. The text of the articles being narrated. It receives no account details.
PostHog, Axiom, and Grafana Cloud. Store our server logs, performance records, and page-speed measurements so we can find and fix problems. PostHog also receives our product analytics events and app error reports. Technical records such as the page path, response status, timings, and sometimes an account ID. They do not receive your email address, your name, passwords, feed credentials, or the titles and addresses of what you add.

Some work runs on services we operate ourselves. Cover images go through our own image service, which runs on Cloudflare. When a website refuses our servers, our own browser service can fetch the public page instead.

When Porchlit fetches an article or a feed, the request comes from our servers. The website sees our servers' address, not yours.

A share or embed link lets anyone who has it play that recording and see its title, source, cover, and transcript. It does not show your name or email address. Revoking the link stops it from working.

Keeping and deleting your data

We keep your data while you have an account. You can delete your account at any time from your profile. When you do, we delete your account data and the audio only you have. That includes your feeds, sources, library, listening progress, and share links.

Some audio is shared between listeners. If another listener has the same article in the same voice, their copy stays in their library. Logs and performance records expire on each provider's retention schedule. Analytics events and error reports stay in PostHog on its retention schedule; they carry only your account ID, which names no one once the account is deleted.

To ask what we hold about you, or to correct it, emailporchlit@aleksiy.dev.

Security

All traffic uses HTTPS. Passwords are hashed and private feed credentials are encrypted. No system is perfectly secure, so please use a password you use nowhere else.

Changes to this policy

When we change this policy, we change the date at the top of this page.

Contact

Privacy questions and requests go to porchlit@aleksiy.dev.