This page describes the technical safeguards currently enabled in StreetAudit. It is a transparency document maintained by the app team — not an independent security certification.

Encryption

• All traffic between your device and our servers is encrypted with HTTPS/TLS.
• Backend databases and object storage are encrypted at rest by our hosting provider (Lovable Cloud / Supabase).
• Passwords are never stored in plain text — they are hashed by the managed authentication service.

Access control

• Row-Level Security (RLS) is enabled on every user-facing table.
• You can only read, edit, or delete your own reports and profile.
• Points can only be awarded to your own account through a security-definer database function that verifies your authenticated identity.
• Administrative service credentials never leave the server side and are never bundled into the browser app.

What we collect on-device

• GPS coordinates are read only while the app is open, using the browser's Geolocation API with your permission. You can revoke this at any time in browser settings.
• Camera and microphone are used only while capturing. Media is stamped with GPS + timestamp before it leaves your device.

Analytics & cookies

• Analytics events are only recorded after you tap "Accept analytics" on our cookie banner.
• We do not use third-party ad trackers.
• Analytics events contain an anonymous session ID, the event name, the page path, and (if signed in) your user ID.

Sharing

Sharing is entirely user-initiated. Reports are shared only when you tap Share, and only through the destination you choose in your OS share sheet.

Incident response

If we discover a security issue affecting your data, we will notify affected users without undue delay via email and post a summary in the app. Report suspected vulnerabilities to the app owner.

Data deletion

You can delete individual reports from your account. To fully delete your account and all related data, contact the app owner listed in the Privacy Policy.

Shared responsibility

The security of your account also depends on you: use a strong unique password, keep your device up to date, and sign out on shared devices.