Security

Protecting what you log in Grrl is our first job.

How we protect Grrl

• Encrypted connections everywhere (HTTPS, HSTS), and encryption at rest by our providers.
• Database access rules on every table, so one account can’t read another’s data.
• A strict Content Security Policy: Grrl runs only its own code and talks only to its own services.
• No third-party trackers, ads or analytics.

Reporting a vulnerability

If you think you’ve found a security problem, email privacy@grrl.app with “Security” in the subject. Please include how to reproduce it. We’ll reply within 3 working days.

While investigating, please don’t access other people’s data (use your own test accounts), don’t disrupt the service, and give us reasonable time to fix the problem before sharing it. We won’t take legal action against good-faith research that follows these rules.