Security and Vulnerability Disclosure

The short version

• Your vault is encrypted on your device and never reaches our servers.
• Found a security problem? Email security@fondfully.com. We'll acknowledge it within three business days.
• If you research in good faith and follow this policy, we won't take legal action against you.

1. How we protect your data

Your vault

• Your vault lives on your device, protected by the operating system's file encryption, with an optional Face ID or biometric app lock.
• Before it's copied to your iCloud or Google Drive, it's encrypted on your device with AES-256-GCM, using a random 256-bit vault key. Each file is authenticated and bound to its name, so it can't be swapped or altered without detection. The only file stored unencrypted is a small manifest holding the vault's technical details and its wrapped keys, never your content.
• The vault key never reaches us. On iPhone with iCloud, it's kept in iCloud Keychain, which Apple end-to-end encrypts. With Google Drive, it's wrapped with a key derived from your passphrase using PBKDF2-HMAC-SHA256 at 600,000 iterations. Every vault also has a recovery code with 160 bits of randomness, and the optional Google Drive copy on iPhone opens only with that recovery code.
• Fondfully asks Google only for access to its own hidden app folder in your Drive, and that access stays on your device.
• Restores are staged and checked file by file before anything on your device changes.
• Fondfully keeps your vault out of your phone's own backups: iCloud Backup and computer backups on iPhone, and Google's device backup on Android.

Gift briefs

• Briefs are encrypted on your device with a new key for each brief. The key is in the link's fragment (after the "#"), which browsers never send to servers, so our servers store only ciphertext.
• Claims are encrypted in the visitor's browser with the same key. The claim form is protected by Cloudflare Turnstile and rate limits.
• Briefs expire after at most 120 days and can be revoked at any time.

Accounts and servers

• An account created with an email and password can't be used until its email address is verified, and signing in with Apple or Google joins an existing account automatically only when both have the same verified email address.
• Passwords are stored as salted scrypt hashes. Access tokens last 30 minutes; refresh tokens are stored as hashes, rotated on every use, and reusing an old one revokes every session.
• Sign in with Apple and Google Sign-In use single-use nonces, and identity tokens are verified against Apple's and Google's published keys.
• Purchases are verified with Apple and Google on our servers.
• Our API and website run on Cloudflare, with HTTPS enforced (HSTS), strict security headers, rate limits and bot protection. Data is encrypted at rest, and especially sensitive tokens are encrypted again with our own key.
• Diagnostics carry no account details and are scrubbed of identifying details, such as email addresses and long numbers, before they're stored. Our servers' own logs contain no IP addresses or request headers, and are kept for 7 days.
• The admin console sits behind Cloudflare Access and requires separate staff accounts with roles, lockouts after failed sign-ins and an audit log. Staff can never see your vault.
• The apps include no third-party analytics, advertising or tracking code.

2. Reporting a vulnerability

Email security@fondfully.com. Please include:

• a description of the issue and where it is;
• the steps to reproduce it, with any proof-of-concept code, requests or screenshots;
• what you think the impact is; and
• how you'd like to be credited, if at all.

Please keep the details confidential until we've fixed the issue (see section 5), and don't include anyone else's personal information in your report beyond what's necessary to show the problem. Reports in English are preferred.

3. Scope

In scope:

• the Fondfully app for iPhone, latest version from the App Store;
• the Fondfully app for Android, latest version from Google Play;
• api.fondfully.com;
• fondfully.com, including gift brief pages; and
• the vault encryption, backup and sync design as implemented in the apps.

Out of scope for testing without our written permission:

• the admin console (admin.fondfully.com) and its sign-in pages. If you notice a problem there, please report it, but don't test it;
• staging and test environments;
• Cloudflare, Apple, Google and other third-party services, including iCloud and Google Drive. Please report issues in them to those providers.

Not accepted as vulnerabilities:

• denial-of-service or load testing, spam, social engineering, phishing, or physical attacks;
• reports from automated scanners without a demonstrated, exploitable impact;
• missing security headers, cookie flags or email authentication records (SPF, DKIM, DMARC) without a demonstrated exploit;
• clickjacking on pages without sensitive actions, self-XSS, and CSV injection without a demonstrated impact;
• software version disclosure, or descriptive error messages without sensitive data;
• rate-limit observations without a demonstrated impact;
• attacks that need a jailbroken or rooted device, physical access to an unlocked device, or an already compromised Apple, Google or email account; and
• a brief's content being visible to someone who has the whole brief link. That's how briefs are designed to work.

4. Rules of engagement

• Only test with accounts and data you own. You can create a few test accounts by hand; don't create accounts automatically.
• Don't access, change, delete or keep other people's data. If you come across it, stop, don't share it, and tell us.
• Don't degrade the Service for others. Keep automated requests to no more than five per second, and stop if you notice any impact.
• Don't try to guess, enumerate or brute-force gift brief links, codes or accounts; demonstrate issues with your own.
• Don't use social engineering, phishing or physical access.
• Give us reasonable time to fix an issue before you disclose it.
• Follow the law. Don't ask for payment in exchange for not disclosing a problem.

5. Safe harbor

If you make a good-faith effort to follow this policy while researching and reporting a vulnerability:

• we consider your research authorized, and we won't pursue or support legal action against you, or report you to law enforcement, for it;
• we waive the parts of our Terms of Service and Acceptable Use Policy that would otherwise restrict your research (such as the restrictions on reverse engineering), to the extent needed for research within this policy; and
• if a third party takes legal action against you for research that followed this policy, we'll make it known that you acted in line with it.

This safe harbor doesn't bind third parties such as Apple, Google or Cloudflare. If you're unsure whether something is allowed, ask us first at security@fondfully.com.

We ask that you give us 90 days, or until the issue is fixed if that's sooner, before you publish details. We're happy to coordinate disclosure with you.

6. What to expect from us

• We'll acknowledge your report within three business days.
• We'll give you an initial assessment within ten business days, and keep you updated at least every 14 days until the issue is resolved.
• We aim to fix critical issues within 7 days, high-severity issues within 30 days, and others within 90 days.
• We'll tell you when the issue is fixed and, with your permission, thank you by name in our release notes or on this page.

We don't currently run a paid bug bounty.

7. If you think your account is at risk

Change your password, open Settings › Signed-in devices and choose Sign out everywhere, then tell us at support@fondfully.com. If you think someone knows your vault passphrase or recovery code, change the passphrase or create a new recovery code in Settings › Sync & backup. We will never ask for your password, vault passphrase or recovery code.

8. security.txt

Our contact details for security researchers are also published at fondfully.com/.well-known/security.txt.