Safety is a design decision.

• Every request to meetwho.app is served over HTTPS with modern TLS. HTTP is redirected, never accepted for user data.
• Data at rest — profiles, events, notes, follow-ups, attachments — is encrypted on the storage layer of our managed cloud backend.
• Uploads (avatars, event covers) are served through signed URLs from an isolated storage bucket, not from the application server.

• Sign-in with Google or Apple, backed by their OAuth flows — MeetWho never sees your password.
• Session tokens are short-lived and rotated. Signing out invalidates the session across the app.
• Sensitive actions (deleting your account, exporting data) require you to be actively signed in.

Every table that holds user data is protected by row-level security policies enforced by the database itself, not just the application. In practice:

• You can only read your own private notes, follow-ups, saved people, requests and messages.
• A public profile is only served for accounts that have chosen to publish it.
• Event data respects the visibility choice of each participant — hidden means hidden.
• Admin-only operations require a role check performed server-side, never trusted from the client.

• Engineer access to production data is restricted, logged, and reserved for keeping the service running or responding to your support requests.
• Backend secrets are stored in a managed secret store — never in client code, never checked into source control.
• We follow least-privilege by default: new services and roles start with no access and are granted only what they need.

• Anyone can send you a request to meet with a short note; nobody can direct-message you until you accept.
• You can decline, mute, block or report any request or account. Blocking is silent on their side.
• Rate limits and pattern detection make mass-messaging and scraping fail fast.
• Reports are triaged by a human. We act on the pattern, not just the instance.

• The database is backed up automatically by our managed provider, with point-in-time recovery.
• Deleting your account removes public and identifying data promptly; anonymised operational logs may be retained briefly for security and abuse investigations.
• We monitor uptime, error rates and slow queries. Serious incidents are communicated in-product and by email where relevant.

MeetWho's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including the Limited Use requirements.

• Google Calendar is the only Google Workspace surface MeetWho connects to, and only after you explicitly authorise it. We request no Gmail, Drive, Photos or Contacts scopes.
• Calendar data is used solely to display your agenda, block busy hours on your booking page, send your own reminders, and sync MeetWho events back to your calendar.
• Google user data — raw, aggregated, anonymised or derived — is never used to create, train, improve or fine-tune AI/ML models, and is never transferred to a third-party AI or ML service.
• MeetWho's AI features run on a separate, auditable data path that reads only MeetWho-native profile, event and intent records. The Google Calendar store is not readable from any AI code path.
• Disconnecting Google Calendar deletes the stored OAuth tokens and imported calendar rows for that account.

If you believe you've found a security vulnerability in MeetWho, please tell us before making it public.

• Use the Contact page and pick the Security topic, or write to hello@meetwho.app.
• Give us a reasonable window to investigate and fix before disclosure.
• Do not access, modify, or delete other people's data while testing. Use your own account.
• We won't take legal action against researchers who act in good faith and follow this policy.

• Turn on 2-factor authentication with your Google or Apple account — that's the door MeetWho signs you in through.
• Review your public profile and event visibility from Settings; hide anything you didn't mean to share.
• Only accept requests from people whose context makes sense — MeetWho tells you why every recommendation exists.
• Report anything that feels off. Silence is not a policy.

Security questions or a concern about your account? Use the Contact page and pick Security. Urgent vulnerability reports: hello@meetwho.app.