Most "user feedback" plugins are just thinly veiled surveillance scripts. They inject heavy tracking pixels, log cursor movement, ship raw database telemetry to centralized SaaS clouds, and create a massive compliance liability.
We refused to build that way.
Today, my team lifted the code freeze on the Pocket Portfolio Feedback Substrate—a stateless, local-first feedback engine engineered for absolute data sovereignty.
Here is the exact technical blueprint of how we solved the user-telemetry paradox on the write-path:
🔹 Zero-Telemetry Trigger Logic
100% client-side eligibility validation. Zero telemetry is shipped on navigation just to determine if a user should see the modal.
// Local-First State Machine
const visitGate = localStorage.getItem('pp_dash_visits');
if (visitGate && JSON.parse(visitGate).count > 5) {
mountFeedbackSubstrate();
}
🔹 Deterministic Privacy (The HMAC Decoupling)
To decouple telemetry metadata from actual user records, identity on the vault/event store uses a strict cryptographic barrier:
anonUserHash = HMAC-SHA256(uid, pepper)
Raw user IDs and emails never touch the analytics collections. The FEEDBACK_ANON_PEPPER remains locked on our server-side secure environment variables.
🔹 Dual-Scrub Sanitization
Data is sanitized client-side before submission, and scrubbed again server-side on the API write-path. If a user accidentally pastes sensitive PII or raw transaction keys, our regex/entropy engine strips it down to anonymous context strings before it hits persistence.
🔹 Restricted Server-Only Write Paths
We bypassed client-direct database writes. All submissions go through POST /api/feedback/submit using the Firebase Admin SDK. The public firestore.rules explicitly block all client-side write access:
match /feedbackSubmissions/{document} {
allow read: if request.auth.token.admin == true;
allow write: if false; // Server-side SDK writes only
}
🔹 Synchronous P0 Escalation
A client reporting a critical, broken UI state (P0) triggers an immediate bypass of standard curation queues. Our API route parses the severity on-the-fly and fires a direct webhook payload alongside a verified Resend transactional dispatch straight to *Emails are not allowed* for immediate triage.
🔹 Static Compilation of Featured Receipts
Our public landing pages (/ and /open) never query the live feedback database. Instead, they load from featuredReceipts. When our team promotes a submission inside /admin/analytics, we compile a sanitized, static excerpt to the public CMS. No leaks, no trace parameters, and no connection back to the sourceSubmissionId.
The code is compiled, the rules are deployed, and the pipeline is officially live. No trackers, no third-party cookies, and no telemetry creep.
If you're on our dashboard, you can force-mount the substrate and audit the network payload using ?showFeedbackModal=true.
Your Data. Your Device. Your Rules.
#LocalFirst #SelfSovereignIdentity #EdgeComputing #SovereignTech #TypeScript