Skip to content
DE
Sign in

Legal

Security

Last updated · Questions:[email protected]

Reporting a vulnerability

Email [email protected]. Include enough to reproduce it. You do not need to ask permission first, and you will not hear from a lawyer.

What we promise:

  • An acknowledgement within three working days, from a person.
  • An honest assessment — including "we already knew" or "we do not think this is a problem", with the reasoning.
  • Credit on this page if you want it, and no credit if you do not.
  • No legal action against anyone who follows the boundaries below, and no request that you keep it quiet indefinitely.

What we ask:

  • Use your own account. Do not access, modify or delete anyone else's data.
  • No denial of service, no spam, no social engineering of us or anyone using Tincograph.
  • Give us a reasonable chance to fix it before publishing. Ninety days is generous; if it is actively being exploited, tell us and publish as soon as it is fixed.

There is no bug bounty. We are a one-person company — offering a reward we could not reliably pay would be worse than saying so.

What protects an account today

  • Passwords are hashed with bcrypt by our identity provider. Nobody here can read one.
  • Two-factor authentication is available on every plan, including free, with recovery codes. See the help centre.
  • Every row of your data is protected by database-level row security, not by application code remembering to check. A query for someone else's data returns nothing, even if the application asks for it.
  • Administrative actions are audited by construction: the check, the change and the audit record are one database transaction, so an action cannot happen without a record of who did it and why.
  • Devices can be revoked individually from your account page, and a revoked device stops syncing immediately.
  • Error reports are redacted before they are stored — tokens, API keys and email addresses are stripped on arrival, not on display. The IP address is kept for 30 days as a rate-limit key and then deleted, as the privacy policy says.
  • Your library originals never reach our servers in readable form. Transfers between your devices are end-to-end encrypted on the sending phone; only the photo you send to an AI feature is readable, for that request. We do not scan your photos.
  • Transport is HTTPS everywhere, with HSTS, a strict content security policy and no third-party scripts.

What does not protect an account yet

Stating these is the point of the page. Each is a real gap, not a hypothetical:

  • There is no limit on failed sign-in attempts. Our identity provider's hook for this is a paid feature; the code that uses it is written and tested but cannot be switched on until the plan changes. Two-factor authentication is the mitigation available to you today, and it is a good one.
  • No independent security audit has been done. When one has, it will be named here with its date.
  • No formal certification — no SOC 2, no ISO 27001. If you need one, Tincograph is not ready for you yet, and we would rather say so than imply otherwise.

Data

Where your data lives and who can see it is on thesubprocessors page; what we collect and why is in theprivacy policy. You can export everything or delete your account from the account page at any time, without asking anyone.

Questions that are not a vulnerability report:[email protected].