Security Policy

Our Commitment to Security

We apply reasonable technical and organisational measures to protect your personal data and ensure the security of the App. While no system can guarantee absolute security, we aim to follow current best practices.

Technical Measures

Our security measures include: - HTTPS/TLS encryption for all data in transit - Securely hashed and salted passwords (passwords are never stored in plain text) - JWT-based authentication with short-lived access tokens and secure refresh token rotation - Per-device session management — you can view and revoke active sessions from Account settings - API rate limiting to mitigate abuse - Backend services run on Cloudflare Workers and data is stored with Scaleway in the EU, with access controls applied to production systems - Personal fields such as email addresses are additionally encrypted at the application level

Payment Security

All payments are processed through Google Play (Android) or the Apple App Store (iPhone/iPad). We do not receive, process, or store payment card details. Payment security is handled by Google or Apple and your card issuer, depending on your device.

Data Storage

Your account and usage data is stored in a managed PostgreSQL database hosted by Scaleway in the EU and accessed by our backend services running on Cloudflare. Personal fields such as email addresses are additionally encrypted at the application level. We apply access controls to limit who can access production data.

Vulnerability Disclosure

If you discover a security vulnerability in the App or our infrastructure, please report it responsibly by emailing [email protected] with a description of the issue. We will investigate all reports and aim to respond within 5 business days.

Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (Finnish Data Protection Ombudsman) as required by GDPR.

Your Role in Security

You can help keep your account secure by: - Using a strong, unique password - Signing out of devices you no longer use (via Account → Sessions) - Managing linked family devices and removing any devices that should no longer have access - Contacting us immediately if you suspect your account has been compromised