The application uses hashed account passwords, HttpOnly sign-in cookies, expiring sessions, owner-based access checks and request limits on sensitive endpoints. Image uploads have file-type and size restrictions. Published invitations ask search engines not to index them.
These controls reduce risk; they do not guarantee that a service will be free of vulnerabilities. We do not claim SOC 2 or ISO certification, an independent penetration test, end-to-end encryption, or guaranteed availability.
An invitation link is shareable. Set a page password if you need another access barrier, and share both carefully. Guests can still copy content they can view. Upload only photos you have permission to publish and avoid unnecessary sensitive information.
Use a strong, unique password or protect the Google account you use to sign in. Log out on shared devices. Keep exports in a safe location and contact us promptly if you suspect account misuse.
Send a private report to [email protected] with the subject “Security report”. Include the affected URL, a clear description, safe reproduction steps and the potential impact. Remove passwords, tokens, guest information and other secrets from your report.
Test only accounts and content you control. Do not access others’ information, disrupt the service or publish exploit details while we investigate. We will review reports and coordinate an appropriate fix. There is no published bug bounty or guaranteed reward.
Where an incident affects personal information, we assess the impact and notify affected controllers, individuals or regulators as applicable law requires. For privacy rights use our Privacy Policy; for other security concerns contact [email protected].