Cycletide security
Cycletide is not available yet. This is the pre-release version of this document: it describes the app as it is built today, and it will be finalised before the app is released.
Found a security problem? Email support@techatpt.com with "Security" in the subject. Tell us what you found, how to reproduce it and what it could affect. Please do not send anyone's personal or health information, including your own.
What this covers
- The Cycletide app for iPhone and Android.
- The backend the app calls for its optional features: purchase checks, the free preview check, the encrypted backup and partner sharing.
- This website, health.techatpt.com.
Apple's and Google's stores and Google Cloud itself are run by those companies; report problems in them to them.
What we ask of you
- Test only with your own phone, your own records and your own backup or invitation.
- Never open, change or delete someone else's information. If you reach information that is not yours, stop and tell us.
- Do not slow down or flood the backend or the website, and do not send spam.
- Do not try to trick people, including us, into giving you access.
- Give us reasonable time to fix the problem before you tell anyone else.
What we do
- We aim to reply within 5 business days and to keep you told about the fix.
- We fix problems according to the risk they create. If one put people's information at risk, we follow the "Security Incidents" section of our privacy policy.
- If you act in good faith and follow this page, we will not take legal action against you for your research, and we will thank you by name if you wish.
- We do not pay for reports.
How Cycletide protects information
Your records stay on your phone, in a database encrypted with a key kept in the phone's secure storage. The optional backup and partner summaries are encrypted on your phone with keys we never hold, so we cannot read them. The backend accepts no direct access from apps or browsers, limits how often it can be called, and keeps no health information. The privacy policy explains what leaves your phone, and only if you turn it on.