How we keep your journal safe.

Signing in

• There are no passwords to guess, reuse or leak. We email a sign-in link to your address, and the link works once.
• Too many sign-in requests in a short time are refused.
• Signing out removes your session from that device. Do it on any computer you share.

Your journal

• Every table that holds your data has row-level security: the database itself only returns rows that belong to the signed-in account, whatever the app asks for.
• Entries are validated before they are saved: dates, ranges and text lengths are checked on the way in.
• Your offline copy holds the app's pages and artwork only. Your entries are read fresh from your account each time.
• You can erase everything yourself from Settings. See the privacy policy for what we keep and who handles it.

Payments

Plus is paid through Stripe, which is certified to the payment-card industry's security standard (PCI DSS). We never see or store a full card number. Messages from Stripe about your subscription are verified before we act on them, so nobody else can grant themselves a plan.

The weekly reading

• It is available only to Plus accounts, and only for your own entries.
• It can be made once per week: the limit is enforced by the database, so a retry or a second tab cannot trigger another.
• Your email address and name are not sent with the entries. Under Anthropic's commercial terms, Anthropic may not train its models on what is sent.

This website and the app

• Everything is served over HTTPS, with browser security headers that stop other sites from framing our pages and limit what the browser shares and which features it may use.
• Secret keys live in our hosting provider's encrypted settings, never in our code or in your browser.
• Account deletion cancels the subscription before it removes anything, so a failure never leaves you paying for an account that is gone.

What you can do

• Keep the email account you sign in with secure: it is the key to your journal.
• Don't forward your sign-in links.
• Sign out on shared devices.
• Our emails come only from innerhelix.app addresses, and we never ask for a password or card details by email.

Reporting a security problem

If you think you've found a weakness in the site or the app, email support@innerhelix.app with "Security report" in the subject. Tell us what you found, how to reproduce it, and what it could affect.

• We aim to reply within 3 business days and keep you posted until it is fixed.
• Please give us reasonable time to fix it before you tell anyone else.
• Test only against your own account. Don't access other people's data, run automated scans or denial-of-service tests, or use social engineering.
• We won't take legal action against anyone who reports in good faith and follows these rules. We're a small business and don't run a paid bug bounty, but we'll gladly credit you if you'd like.

If something goes wrong

If a problem ever affects your information, we will fix it, tell the people affected by email as soon as we know what happened, and explain what to do next.

Changes

If this policy changes, the effective date at the top changes with it.