Security

Report a vulnerability

Contact Support with what you found and how to reproduce it. If you have no account, use the public contact form and choose "A security vulnerability". We will confirm receipt and keep you updated.

Testing within your own account is welcome. Do not access or modify other people's data, disrupt the service or run automated production scanners. We do not currently offer a paid bug bounty.

Protection measures

• Account access controls separate customers' data.
• Our authentication provider stores password hashes, not passwords. Stripe handles card details; they do not reach our servers.
• HTTPS protects data in transit. Browser security headers, request limits and file-size and file-type restrictions provide additional protection.
• PNG, JPEG and WebP uploads have metadata removed before moderation and storage. SVG, PDF and font files are stored as uploaded. Video and audio files are stored as uploaded, including any location data they carry.
• Photos, video and audio of real people are kept in private storage that only the character's owner can reach through the service.
• Content moderation decisions are recorded for accountability.

Current limitations

Error monitoring is not connected to alerts. Database point-in-time recovery is not enabled.

For data retention, deletion and your rights, see the Privacy Policy.