Security

How we protect your things

• Encrypted connections. Every page and request uses HTTPS.
• Passwords. Stored only as a slow, salted hash (scrypt), never in plain text, never in logs.
• Encryption inside the app. Journal text, calendar links and the copy of your calendar events are encrypted (AES-256-GCM) before they reach the database, with keys kept apart from it. The database is also encrypted on disk by our provider.
• Walls between accounts. Every request is checked against the signed-in account, and automated tests try to read and change other people’s data on every change to the code.
• Sign-in limits. Repeated sign-in attempts from one address are slowed down.
• Your sessions. You can sign out every other device from Settings, and changing or resetting your password does it for you.
• Calendar links. Our server reads them with guards that stop it from reaching private networks, with size and time limits.
• Nothing extra on the page. No ads, no trackers, no third-party scripts.
• Data in the EU. The database is in Frankfurt, Germany. Only Sarmad Aslam can reach the live systems.

Report a security problem

Email msarmadaslam@gmail.com with “Security” in the subject. Please include what you found, the steps to reproduce it, and the page or address involved. Do not send other people’s data.

• We confirm we received it within 3 working days, and keep you updated.
• We fix real problems as fast as we can, and thank you by name if you want us to.
• There is no paid reward programme yet.

Rules for testing

• Test only with accounts you own.
• Do not open, change or delete other people’s data. If you reach any by accident, stop and tell us.
• No denial of service, no spam, no tricking people (social engineering) and no physical attacks.
• Give us 90 days to fix a problem before you talk about it publicly.

Safe harbor

If you research in good faith and follow these rules, we will not take legal action against you or ask anyone else to, and we treat your work as authorised. If in doubt, ask us first.

For security researchers, the same details are in /.well-known/security.txt.