Security

How we protect your account

• All traffic uses HTTPS. Passwords are stored hashed, never in plain text.
• Short sessions renewed automatically; see and sign out connected devices in Settings.
• Temporary lockout after 5 wrong password attempts.
• Email alert when someone signs in to your account on a new device.
• Face ID and fingerprint are checked by your phone itself.
• Each household's data is isolated; the admin team uses two-step verification and every access is audited.

Report a vulnerability

Found an issue? Email [email protected] with steps to reproduce. Don't access other people's data or disclose the issue before we fix it. We will review the report and reply through the same channel.