← SuperhotGeo
Security & Privacy
Last updated July 26, 2026 · Questions: info@superhotgeo.com
Directory data, accounts, and paid API access are protected with the same seriousness we bring to the energy data itself.
You are safe to take this seriously
SuperhotGeo is built by Family Farms Forever LLC. We treat cybersecurity and privacy as product requirements — not afterthoughts. Below is what we do in plain language, and how to reach us if something looks wrong.
Report a vulnerability
Email info@superhotgeo.com with a description and steps to reproduce. Please do not post exploits publicly. Good-faith research is welcome. We aim to acknowledge within 2 business days.
Our baseline protections
- Encryption in transit — connections to our hosted sites and APIs use HTTPS (TLS), as provided by Firebase Hosting and Google Cloud.
- Encryption at rest — data stored in Firebase/Firestore is encrypted at rest by Google Cloud with Google-managed keys (standard Firebase platform protection).
- Signed-in access control — Firebase Authentication and Firestore security rules are used so private records are not left world-readable; access is limited by design to the account (or linked roles such as parent/teacher) that should see them.
- Secrets stay out of the app binary — server-side API keys and payment secrets are stored in Google Cloud Secret Manager (or equivalent cloud config) for Cloud Functions — not hardcoded into the public client apps.
- Payments by specialists — card payments are processed by Apple In-App Purchase, Google Play Billing, and/or Stripe Checkout/Elements. Our design is that full card numbers (PAN) are not stored in our application databases.
- No sale of personal data — we do not sell your information to data brokers or ad networks.
- Account deletion — available in-app or by request so you can leave cleanly.
- Metered public APIs — public machine-readable APIs include rate limits (and optional API keys with usage metering) so automated bulk access is constrained.
Specific to SuperhotGeo
- Public research data vs private accounts — public directory resources are intentionally open for citation; private account and payment data are not.
- Metered API keys — anonymous, free, and paid tiers with daily caps so commercial bulk use is accounted for.
- Payments — Stripe for subscriptions and data-API SKUs; card data does not rest on SuperhotGeo servers.
- AI surfaces — assistant answers are grounded in SuperhotGeo’s curated sources; we do not sell your chat history to advertisers.
Full legal detail: Privacy Policy · Terms.
What we do not claim (yet)
- We may not yet have a published SOC 2 letter for this product.
- We do not currently run a paid public bug-bounty program.
- When a third-party penetration test is completed, we will note it here.
We would rather be honest than over-promise. The engineering practices above are real and continuously maintained.
Related
SuperhotGeo is developed by Family Farms Forever LLC. Security contact: info@superhotgeo.com.