01About this policy
The current design uses account checks, private storage and recovery paths. This page describes implementation without claiming an independent certification.
02The data flow
Supabase handles authentication and Notes storage. Cloudflare runs the site, API, account-scoped Finance state, private file storage and application recovery snapshots. Optional paystub reading sends selected originals to Google Gemini only after the in-app permission flow.
03Account separation
Private API requests resolve the account from its session. File ownership is checked, Finance state is separated by account, and stale Finance writes require revision checks. Provider secrets remain on the backend. The browser playground cannot read an app account.
04Recovery and deletion
Protected local state and server revision snapshots support recovery. Restricted application snapshots expire within 30 days. Account deletion has password verification, durable retries and recovery exclusions. Other offline devices and previously exported copies cannot be remotely erased. See Privacy for the full boundaries.
05Operational limits
No SOC 2, ISO certification, penetration-test completion, Plaid approval or App Store approval is claimed here. Vendor retention settings and operational controls require ongoing verification. A live component check is not proof that every account action will succeed.
06Security policy and procedures
Our documented information security policy is available at /legal/information-security. It defines access, change review, vulnerability handling, incident response, recovery and review requirements. Published procedures do not establish that all operational checks have been completed.
07Report a concern
Email tonideb@gophaze.com with a concise description and steps to reproduce using synthetic data. Do not send passwords, API keys, account credentials or unredacted paystubs. We will review reports; there is no announced paid bounty program.
08Passkeys and account recovery
Web passkey management and one-use recovery phrases are available on the account security page. Biometric verification happens on your device; the service does not receive biometric templates. Authorized GoPhaze operators can access information needed for their assigned duties. Hosted service data is not described as end-to-end encrypted against the operator.