Security

• No microphone and nothing about what is played. No contacts, photos, messages or advertising identifiers.
• Raw motion data from the earbuds is turned into a posture state on the phone and never leaves it. Only state changes and session summaries are synced.
• Location is taken only at the moment an earbud is dropped or left behind (plus low-accuracy updates if you turn on background monitoring), and event locations are deleted after 7 days.
• Live state expires after 10 minutes; raw samples are kept for 30 days, minute aggregates for 90 days.

All traffic between the apps, the web dashboard, this website and our servers uses TLS (HTTPS, with HSTS on our websites). Our servers are hosted in the EU; databases, disks and backups are encrypted at rest. Backups are encrypted and kept for 30 days, then overwritten.

• Passwords are never stored in readable form; we keep only a bcrypt hash. Answers to security questions are hashed with bcrypt as well and are never shown again.
• App accounts use a 6-digit PIN. Trivial PINs such as 111111 or 123456 are refused, and repeated wrong attempts lock the account for a while.
• Signing in with an email and password always ends with a one-time code sent to your email. The sign-in flow is bound to the device that started it: a code can't be used to finish a sign-in on another device.
• Changing your password takes three steps: your current password (and security answer), a code by email, then the new PIN. Other sessions are signed out and you get a confirmation email.
• Sign in with Apple and Google sign-in use the provider's own verification.
• Children have no email or password. A parent pairs their device with a 6-digit code or QR that works once and expires after 10 minutes.

• Rate limits on sign-in, sign-up, codes and other sensitive endpoints.
• Cloudflare Turnstile checks that a human is behind sign-up, sign-in, password changes and the contact form.
• On the web dashboard, session tokens live in HttpOnly cookies that page scripts can't read.
• This website sends a strict Content Security Policy, refuses to be framed and rejects cross-site form posts.

One authorization rule is checked on every request, live update and report: a person sees themselves, and a parent sees only the members linked to them. Schools see only anonymous class averages, never an individual child.

Inside our team we follow least privilege: people get only the access their job needs. Admin accounts use strong passwords and two-step verification, and every look at personal data is written to an audit log.

We use Sentry to learn about crashes and errors. Reports carry only an opaque user id: no IP address, no screenshots, no view hierarchy and no names or emails. Server logs and metrics go to Better Stack; one-time codes are never written to logs in production.

We monitor our systems and follow a written incident response process: contain, investigate, fix, and learn from it. If a personal data breach puts your rights at risk, we notify the competent supervisory authority without undue delay (under the GDPR within 72 hours of becoming aware of it) and tell affected users directly, as the laws of their country require.

• Choose a PIN that isn't your birthday or the one you use for your phone.
• Keep your email account secure: sign-in codes go there.
• Only scan pairing QR codes your family created, and pair children's devices in person.
• If you get a sign-in code you didn't ask for, change your PIN and tell us.
• Keep iOS and the app up to date.

Something looks wrong with your account? Write to support [at] earbunny.app.