06Legal

Security

Last updated: September 21, 2026

Super Serious Software LLC builds iOS applications. Security and privacy are design constraints for us rather than features added at the end. This page describes the safeguards we maintain. It is a description of our practices, not a warranty or a contractual commitment.

Data Minimization

We collect the least information needed to operate our apps. Wherever a feature can work entirely on your device, we build it that way, and data that never leaves your device is data we cannot lose. We do not sell personal information, and we do not operate an advertising business.

Encryption

All traffic between our applications and our servers is encrypted in transit using TLS 1.2 or higher, with modern cipher suites and certificate validation enforced by the operating system.
Data stored on our servers is encrypted at rest using AES-256 or an equivalent standard provided by our infrastructure provider.
On-device data is protected by iOS Data Protection and the device's hardware-backed encryption. Credentials and tokens are stored in the iOS Keychain, not in application preferences.
Data synced through your personal iCloud account is encrypted and managed by Apple under Apple's security model and is not accessible to us.

Authentication and Access Control

Access to production systems is limited to personnel who need it, granted on a least-privilege basis, and reviewed at least annually and upon any role change or departure.
Multi-factor authentication is required on all accounts with access to production infrastructure, source code, the Apple Developer account, and email.
Administrative access is performed through individually attributable accounts. Shared credentials are avoided, and secrets are stored in a managed secret store rather than in source code or configuration files.
Where we offer accounts, user passwords — if used — are stored only as salted hashes produced by a modern password-hashing function such as bcrypt, scrypt, or Argon2. We support Sign in with Apple to reduce the number of credentials you need to manage.

Application and Infrastructure Security

Our infrastructure runs on Vercel, in the United States, and inherits that provider's physical security, redundancy, and network controls.
Servers and dependencies are patched on a regular cadence, with security updates prioritized based on severity.
Third-party dependencies are tracked and monitored for known vulnerabilities, and are updated when advisories are published.
Code changes are reviewed before release, and production deployments are performed through an automated pipeline with an auditable history.
Development, staging, and production environments are separated, and production data is not copied into development environments.
Our apps are distributed exclusively through the Apple App Store, and are signed and subject to Apple's review and platform protections.

Monitoring and Incident Response

We log access to production systems and monitor for errors, anomalous activity, and availability problems.
We maintain a written incident response process covering detection, containment, eradication, recovery, and post-incident review.
If a security incident affects your personal information, we will notify you and any applicable regulators without undue delay and within the timeframes required by law — including New York's SHIELD Act and breach notification statute, the GDPR's 72-hour regulator notification requirement, and other applicable state laws.

Vendors

We keep our vendor footprint small. Before engaging a provider that will process personal information, we review its security posture and enter into a written agreement, including a data processing addendum with Standard Contractual Clauses where required. Our current service providers are listed in our Privacy Policy.

Retention and Deletion

We retain personal information only as long as needed for the purposes described in our Privacy Policy. When you delete your account, we delete your content from production systems within 30 days, and from encrypted backups within the ordinary backup rotation period of 90 days. Retention periods for specific categories of data are set out in the Privacy Policy.

Business Continuity

Production data is backed up daily, backups are encrypted, and restoration is tested periodically. We design for graceful degradation so that, wherever possible, our apps continue to function on-device during a service interruption.

Your Role

Security is shared. Keep iOS and our apps updated, use a device passcode along with Face ID or Touch ID, enable two-factor authentication on your Apple Account, and use a unique password if you create an account with us. We will never ask you for your password or for a two-factor code by email, message, or phone.

Reporting a Vulnerability

We welcome reports from security researchers. Send details to contact@superserioussoftwarellc.com, including the affected app or endpoint, the version, reproduction steps, and the impact you believe the issue has. We aim to acknowledge reports within 3 business days and to provide a remediation timeline within 10 business days.

If you make a good-faith effort to comply with this policy during your research, we will consider your research authorized, will work with you to understand and resolve the issue quickly, and will not pursue or support legal action against you. In return, we ask that you give us reasonable time to remediate before public disclosure; that you avoid privacy violations, data destruction, service degradation, and any access to data beyond the minimum needed to demonstrate the issue; that you do not perform denial-of-service, social engineering, physical, or spam testing; and that you do not access, modify, or retain data belonging to other users.

We do not currently operate a paid bug bounty program, but we are glad to credit researchers publicly with their permission.

No Guarantee

No system is perfectly secure. While we work to protect your information using commercially reasonable safeguards, we cannot guarantee that unauthorized access, disclosure, alteration, or destruction will never occur.

Contact

Super Serious Software LLC
New York, NY
contact@superserioussoftwarellc.com