Security

Connections to the service use HTTPS/TLS. Our database, hosting, and media providers apply encryption and access controls to stored data under their respective security programs.

Authentication is provided through Supabase and supported identity providers. We do not receive your identity-provider password. Private product APIs validate the signed-in account, and sensitive database access is limited to server-side routes with Row-Level Security used as defense in depth.

Our infrastructure uses Supabase for authentication and PostgreSQL, Cloudflare for media delivery and storage, Vercel for web hosting, and Upstash for rate limiting. Access is restricted by purpose, and public and private product surfaces are separated at the API layer.

We use a restricted Sentry configuration for crash and error diagnosis without session replay or advertising analytics. We monitor for security anomalies and unauthorized access attempts. In the event of a security incident, we investigate, contain, remediate, and provide notifications when required by law.

Child profiles are protected by parent controls. They use a display handle, preset avatar, and broad content-level preference; exact birth dates and child contact details are not requested. AI safety controls reduce risk but are not perfect, so adults review stories and explicitly add completed items to Family Playback. Child profiles cannot access the adult Community feed or create and publish stories.

If you discover a security vulnerability in our platform, please report it responsibly by emailing [email protected]. We ask that you allow us a reasonable time to investigate and address the issue before making any public disclosure. We appreciate the security research community's efforts in keeping our users safe.