Security and Responsible Disclosure

How we protect your data

• Less data, less risk: photos and face landmark points are stored on your device and never on our servers. Backup is optional, holds results as numbers only, and our server checks every backup and refuses image data and landmark points.
• No passwords: an account is optional, and sign-in uses Sign in with Apple or a one-time email code, so there is no password to steal. A code works once, expires after 10 minutes and allows five attempts.
• Secrets hashed or encrypted: sign-in tokens and email codes are stored only as hashes, and the Sign in with Apple token is stored encrypted. A session ends 180 days after it was last used, and signing out ends it at once. Each sign-in starts a new session and ends the one before it.
• Your data only: every request for account or backup data is checked against the session that made it. No request can name another person's account. An account has one sign-in method, and a second way in cannot be attached to it.
• AI requests are not kept: they are processed in memory and never stored. Our event log holds event names with account ids and Apple transaction ids, never request content, tokens, email addresses, codes, photos or chat.
• Encryption in transit: all traffic uses HTTPS, with HTTP Strict Transport Security.
• Hardened responses: security headers block framing, content-type sniffing and access to the microphone and location; the camera is allowed only for our own pages.
• Abuse controls: request size limits, input validation and rate limits on our API. Rate-limit counters are stored under a keyed hash of the IP address, account id or email address, never the value itself, and are deleted within 2 days.
• Secrets on the server only: API keys for our AI providers never reach your device.
• Payments: handled by Apple through the App Store. We never see your card number or other payment details. Our server accepts a purchase or a notice from Apple only after checking Apple's signature on it.
• Deletion: Delete account in the app removes your account and the data linked to it from our database, and ends every session. Apple's transaction records stay, with the link to the account removed. The Sign in with Apple token is revoked by Apple: if Apple does not confirm at once we retry, and the waiting token is deleted after 30 days at most.

Reporting a vulnerability

Email [email protected] with a description of the issue, steps to reproduce it, its likely impact and any proof-of-concept. Please include how we can reach you and whether you would like to be credited. Our contact details are also published in our security.txt file. We do not currently run a paid bug bounty.

Scope

In scope:

• lookflex.app and its subdomains operated by us, including our /api endpoints;
• the LookFlex iPhone app.

Out of scope:

• services run by others, such as Apple, Vercel, Anthropic, Google and Resend (report to them directly);
• denial-of-service or volume testing, and spam;
• social engineering, phishing or physical attacks on our team or providers;
• reports from automated scanners without a demonstrated, exploitable impact;
• missing best-practice headers or settings with no demonstrated security impact;
• issues that need a jailbroken or already-compromised device.

Rules of engagement

• Only test against your own data and your own devices.
• Do not access, change or delete other people's data. If you come across any, stop, do not keep it, and tell us.
• Do not degrade the service for others, and keep automated testing to a gentle rate.
• Do not use the AI features to generate harmful content as part of testing.
• Give us reasonable time to fix the issue (normally 90 days) before telling anyone else.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue or support legal action against you for it, including under anti-hacking or anti-circumvention laws or our Terms of Service, and if a third party takes action against you over research that followed this policy, we will make it known that you acted with our authorisation. This does not cover activity that breaks the law or harms our users.

What happens next

• We will acknowledge your report within 3 business days.
• We will assess it and keep you updated, at least every 14 days, until it is resolved.
• Once it is fixed, we will credit you publicly if you would like us to.