Keeping your
trust safe

How we protect your data

• Encrypted connections. The app, the web app and this website talk to our servers over HTTPS only.
• No passwords. You sign in with Google, Apple or a one-time link sent to your email, so there's no First Saff password to steal or reuse.
• Rules in the database. Row-level security in the database decides what each person can read and change, so the app can't reach anything you aren't allowed to see.
• Less to lose. We keep as little as we can. Your location stays on your phone, and photos are resized there before upload, which removes hidden GPS data. The privacy policy lists everything we keep.
• A quiet website. firstsaff.com loads only its own scripts and styles, with no ads, trackers or third-party code.

Report a security problem

If you think you've found a vulnerability in First Saff, please email hello@firstsaff.com with "Security" in the subject. Tell us what you found, where, the steps to see it, and what someone could do with it. We'll confirm we've got it and keep you updated until it's fixed.

While you look

• Use your own account, and don't read, change or delete other people's data beyond the least you need to show the problem.
• Don't run tests that could slow First Saff down or flood it, such as denial-of-service or spam.
• Give us a fair chance to fix it before you share it with anyone else.

If you follow these steps and act in good faith, we'll treat your report as help, and we won't take action against you for it.

Not what we're after

• Reports from automated scanners that don't show a real way to cause harm.
• Tricking people, such as phishing, or anything that needs physical access to someone's phone.
• Problems in other services, such as Google, Apple or the makers of a connector. Please report those to them.

Thank you

We can't pay rewards yet. With your permission, we'll thank you by name on this page once a problem you reported is fixed.

Security researchers can also find our contact details at /.well-known/security.txt.