Safety is a design decision.

• Every request to meetwho.app is served over HTTPS with modern TLS. HTTP is redirected, never accepted for user data.
• Data at rest — profiles, events, notes, follow-ups, attachments — is encrypted on the storage layer of our managed cloud backend.
• Uploads (avatars, event covers) are served through signed URLs from an isolated storage bucket, not from the application server.

• Sign-in with Google or Apple, backed by their OAuth flows — MeetWho never sees your password.
• Session tokens are short-lived and rotated. Signing out invalidates the session across the app.
• Sensitive actions (deleting your account, exporting data) require you to be actively signed in.

Every table that holds user data is protected by row-level security policies enforced by the database itself, not just the application. In practice:

• You can only read your own private notes, follow-ups, saved people, requests and messages.
• A public profile is only served for accounts that have chosen to publish it.
• Event data respects the visibility choice of each participant — hidden means hidden.
• Admin-only operations require a role check performed server-side, never trusted from the client.

• Engineer access to production data is restricted, logged, and reserved for keeping the service running or responding to your support requests.
• Backend secrets are stored in a managed secret store — never in client code, never checked into source control.
• We follow least-privilege by default: new services and roles start with no access and are granted only what they need.

• Anyone can send you a request to meet with a short note; nobody can direct-message you until you accept.
• You can decline, mute, block or report any request or account. Blocking is silent on their side.
• Rate limits and pattern detection make mass-messaging and scraping fail fast.
• Reports are triaged by a human. We act on the pattern, not just the instance.

• The database is backed up automatically by our managed provider, with point-in-time recovery.
• Deleting your account removes public and identifying data promptly; anonymised operational logs may be retained briefly for security and abuse investigations.
• We monitor uptime, error rates and slow queries. Serious incidents are communicated in-product and by email where relevant.

If you believe you've found a security vulnerability in MeetWho, please tell us before making it public.

• Use the Contact page and pick the Security topic, or write to security@meetwho.app.
• Give us a reasonable window to investigate and fix before disclosure.
• Do not access, modify, or delete other people's data while testing. Use your own account.
• We won't take legal action against researchers who act in good faith and follow this policy.

• Turn on 2-factor authentication with your Google or Apple account — that's the door MeetWho signs you in through.
• Review your public profile and event visibility from Settings; hide anything you didn't mean to share.
• Only accept requests from people whose context makes sense — MeetWho tells you why every recommendation exists.
• Report anything that feels off. Silence is not a policy.

Security questions or a concern about your account? Use the Contact page and pick Security. Urgent vulnerability reports: security@meetwho.app.