Data minimization
The receiver experience is designed around the smallest useful audience signal. Channel owners can work with subscriber totals and delivery outcomes without receiving the personal identity behind each subscription.
Access boundaries
Authentication, workspace permissions, API credentials, and operational systems are separated by role and purpose. Production services are restricted to the paths and identities they need, and sensitive credentials are kept out of source code and client-visible pages.
Encryption and secure transport
Public web and API traffic is served over HTTPS. Service-to-service and data-store connections use private networking or authenticated transport where configured. Credentials and tokens are handled as secrets and should be rotated if exposure is suspected.
Monitoring and response
We use operational monitoring, error reporting, and audit-friendly logs to detect failures, investigate suspicious activity, and improve reliability. Logs are designed to support diagnosis without turning personal information into a product.
Third-party providers
Hosting, authentication, analytics, error reporting, and delivery partners may process limited data to provide their services. We select providers appropriate to the job, configure them for production use, and avoid sharing PII for advertising or unrelated profiling.
Your part in security
Use a strong account, protect your Google account and API tokens, review integrations, and report suspicious activity through the support channel available in your account. Do not place passwords, private keys, or unnecessary PII in nudge content.
A practical limitation
No online service can promise absolute security. We continuously review controls, respond to incidents, and improve the product as we learn. If you believe you have found a security issue, report it privately through the support channel available in your account and include enough detail for us to reproduce it safely.