Security
Security
How we protect your data
- Less to protect. Your birth details, charts, readings and questions are kept on your phone, not on our servers. The app has no endpoint that accepts a birth time or coordinates.
- Encrypted on the device. Profiles are kept in an encrypted database on your phone. Backups you save yourself are encrypted with a passphrase only you know, so we cannot read them or recover a lost passphrase.
- Encrypted in transit. The few things that do reach our servers (your sign-in, your subscription status) travel over HTTPS.
- Nothing from other companies on this site. Strict content-security and transport headers are set, and the site loads no third-party scripts.
- Camera frames stay local. Palm and tea-leaf scans are read live on the phone; no photo is saved or uploaded.
Report a vulnerability
If you think you have found a security problem in the app, the website or the servers, please email [email protected] with the subject Security. Include what you found, how to reproduce it and what you think the impact is. Our contact details are also in security.txt.
Please:
- give us a reasonable time to fix the problem before you tell anyone else;
- test only against your own account and data, and stop if you reach someone else's;
- do not run denial-of-service tests or social-engineering attacks against our people or users.
We will acknowledge your report, keep you informed, and thank you in public if you wish. We do not currently run a paid bug-bounty programme.
See also the Privacy Policy and how to delete your account.