Security

Security

A draft does not send until a person says yes. The SDK talks to the API and does not open the database. This page is not an audit report.

The app and the API

The SDK talks to the API. It does not open the database. Country is taken from the IP address, and the IP address is not stored. The SDK does not start location services because the host app already has location permission.

A crash report for our own binary does not include the notification text, the push token, or a user id.

A send

A draft does not send. A person says yes, and that yes is the send. One key can draft for the apps in the account. The bill stays per app.

A server send uses a separate REST key for one app. That key can be locked to IP addresses. The key inside the app cannot send.

This website

The public pages do not ask for a password. They set an essential session cookie and a cookie that checks a form post. They do not set an advertising cookie.

Reporting a vulnerability

Write to the registered office. Include the page or the behaviour, and the least amount of detail that shows the issue. Do not send live keys or tokens. We will reply by post or by the address you give.