Security Overview
Technical and organisational measures, what data we hold, and how to report a vulnerability.
- Last updated
Data we hold
| Data | Where | Detail |
|---|---|---|
| Subscription state (Jesus — WWJD only) | RevenueCat | Pseudonymous identifier. No name, email or payment details. |
| Product analytics (Jesus — WWJD only) | Amplitude | Event metadata only, never content. Pseudonymous device identifier. |
| Email correspondence | Mail provider | As sent by the user. Deleted after 2 years. |
| Purchase and tax records | Accounting records | Anonymised sales reports from Apple. Retained 7 years. |
| Web server logs | Vercel | IP, URL, user agent, timestamp. |
Content created in our apps is held on the user’s device and is not transmitted to us.
Application security
- Inference is performed on the device. No prompt, document or generated output is transmitted for inference.
- No accounts. No credentials, session tokens or account recovery flow.
- Cloister AI verifies subscriptions on the device through StoreKit. No purchase record is transmitted.
- Bilingual Baby and Best Dad make no network requests.
- Meeting audio is not written to disk in Cloister AI. Speech is converted to text in memory and the samples discarded.
Data at rest
App content is stored in the app’s container and protected by iOS file-level encryption, tied to the device passcode and the Secure Enclave. No additional application-level encryption layer is applied.
Data in transit
TLS 1.2 or higher for all network requests. Arbitrary cleartext loads are disabled at the App Transport Security level.
Secrets
No production API credential is included in any app binary. The one third-party API requiring a server-side key — text-to-speech in Jesus — WWJD — is reached through a proxy that holds the credential, stores nothing and logs no content. Signing keys and production configuration are held outside version control.
Permissions
Each app requests only the permissions its features require. Each can be refused or revoked without disabling the rest of the app. Permissions are listed in each app’s privacy policy.
Website security
- Static site. No server-side rendering at request time, no database, no application server, no user input accepted.
- No cookies, no analytics, no third-party resources. See the Cookie Policy.
- Content Security Policy restricting all resource types to this origin.
- HSTS with a long max-age.
X-Content-Type-Options: nosniff,Referrer-Policy: strict-origin-when-cross-origin,X-Frame-Options: DENY, and a restrictivePermissions-Policy.- TLS terminated by Vercel with automatically renewed certificates.
Organisational measures
- Multi-factor authentication on every account with access to the data above.
- Hardware-backed authenticators where supported by the provider.
- Third-party API keys scoped as narrowly as each provider allows.
- Private source control, signed releases, no secrets in version control.
Reporting a vulnerability
Include what you found, how to reproduce it, and the impact.
| Stage | Target |
|---|---|
| Acknowledgement | 3 business days |
| Initial assessment | 10 business days |
| Fix for a critical issue | 30 days |
| Credit, on request | This page and the release notes |
Safe harbour. Where you make a good-faith effort to comply with this policy, we will not pursue or support legal action against you. Do not access or modify data that is not yours, do not degrade our services, do not use social engineering or physical attacks, and allow a reasonable period to remedy an issue before disclosure.
Testing our apps on your own device is permitted.
Breach notification
Where a breach is likely to result in serious harm we will notify affected individuals and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act 1988 (Cth).
Where the GDPR applies we will notify the relevant supervisory authority within 72 hours of becoming aware.
For business customers, the DPA requires us to notify you within 48 hours.
Continuity
Our apps operate locally and do not depend on a server maintained by us. Installed apps continue to function offline irrespective of the availability of this service. Subscriptions are administered by Apple.