Scope

This policy covers software and services we operate:

• The EchoDrop mobile application (iOS and Android)
• Our Supabase backend: database, row-level security policies, edge functions, and storage
• This website (www.getechodrop.com and getechodrop.com)

The following are out of scope, because we do not control them:

• Vulnerabilities in Supabase, Apple, Google, Expo, Resend, Sentry or PostHog themselves (report those to the respective vendor)
• Findings that require a physically compromised, jailbroken, or rooted device
• Reports produced solely by an automated scanner with no demonstrated impact
• Social engineering of our staff or users, and any form of denial-of-service testing
• Missing security headers or best-practice deviations with no demonstrable exploit path

What we ask of you

1. Give us a reasonable window to fix the issue before disclosing it publicly. Our default is 90 days from your report, and we will usually be much faster.
2. Use only accounts you own, or test accounts you created. Never access, modify, or retain another person's data.
3. If you do encounter personal data belonging to someone else, stop immediately, do not save a copy, and tell us in your report.
4. Do not degrade the service for other users. No load testing, no automated brute-forcing against production, no spam.
5. Give us enough detail to reproduce: affected endpoint or screen, steps, and what an attacker gains.

Safe harbour

This safe-harbour commitment does not extend to accessing other people's personal data beyond the minimum needed to demonstrate a finding, to extortion, or to destroying data.

What you can expect from us

Stage	Our commitment
Acknowledgement	Within 3 business days
Initial assessment	Within 10 business days: validity and severity
Progress updates	At least every 14 days while the report is open
Fix for critical issues	Targeted within 30 days of confirmation
Credit	Named in our release notes if you want it; anonymous if you prefer

We do not currently operate a paid bug bounty. We would rather say so plainly than imply a reward that does not exist. Every valid report gets a written response and, with your consent, public credit.

Regulatory reporting

Where a vulnerability you report is being actively exploited, or an incident materially affects the security of EchoDrop, we notify the relevant authorities on the statutory timeline, including, for users in the European Union, reporting through the ENISA single reporting platform under the Cyber Resilience Act, and notifying affected users and supervisory authorities under the GDPR where a personal data breach is involved. Your report may form part of such a notification; we will not name you to a regulator without asking you first.

Machine-readable contact

This policy is referenced from our /.well-known/security.txt, published per RFC 9116.