Security

1. Account protection

• Passwords hashed with bcrypt; never stored or logged in plain text.
• Short-lived access tokens (1 hour) and single-use rotating refresh tokens stored only as keyed hashes. Reuse of an old token signs out that session family automatically.
• Optional authenticator-app two-factor authentication; TOTP secrets encrypted with AES-256-GCM.
• “Sign out of all devices”, and automatic sign-out everywhere after a password reset.
• Rate limits and lockouts against credential stuffing; email verification codes expire in 15 minutes.
• Tokens on your phone live in the iOS Keychain / Android Keystore, with optional biometric unlock.

2. Data protection

• TLS for all traffic (HSTS preload); encryption at rest for the database and file storage.
• Photos in private storage, delivered only through signed links that expire in minutes; GPS and camera metadata stripped on upload.
• Every request is checked against the signed-in user; other people's private data is never returned. Blocked users can't see each other.
• AI and database keys are held only on our servers, never in the app.
• IP addresses and device identifiers are stored as keyed hashes where we need them for fraud prevention.

3. Operations

• Least-privilege staff access with audit logs for administrative actions, authentication, billing and deletion events.
• Strict Content-Security-Policy and security headers on our website; no third-party scripts.
• Webhook authentication and idempotent processing for billing events.
• Automated dependency and vulnerability scanning in CI; secrets never committed to source control.
• A documented incident-response process, including notifying affected users and regulators within legal deadlines (e.g. 72 hours under GDPR).

4. Responsible disclosure

Found a vulnerability? Email security@gainbuddy.fit with steps to reproduce. We acknowledge within 3 business days and keep you updated.

Please test only against your own accounts, don't access or modify other users' data, avoid denial-of-service and social engineering, and give us reasonable time to fix before public disclosure. We will not pursue legal action for good-faith research that follows these guidelines.