STARVY SECURITY

• Encryption in transit. All traffic between the app and our servers uses TLS.
• Encryption at rest. Your data is stored encrypted on infrastructure hosted in the European Union (Frankfurt, Germany).
• Hashed credentials. We never store passwords in plain text.
• Row-level security. Database access rules are enforced at the row level, so your private content is isolated from other users by the database itself, not just by application logic.
• Least-privilege access. Access to production systems is restricted and audited.
• No third-party tracking. We do not embed advertising or analytics SDKs, which means your usage data is not shared with data brokers or ad networks — a category of exposure we've eliminated by design.

No system is perfectly secure, and we won't pretend otherwise. If a security incident affects your personal data in a way that triggers legal notification duties, we will notify you and the competent authorities as required by law.

If you believe you've found a security vulnerability in Starvy — in the app, our API, or our infrastructure — we want to hear from you before anyone else does.

Report to: security@starvy.com

Please include:

• A description of the vulnerability and its potential impact;
• Steps to reproduce it (proof-of-concept code, screenshots, or request/response examples are welcome);
• Your contact details if you'd like updates on the fix.

• We will acknowledge your report within 72 hours.
• We will keep you informed of our progress and notify you when the issue is resolved.
• We will not pursue legal action against researchers who act in good faith: who make reasonable efforts to avoid privacy violations, data destruction, and service disruption; who do not access or modify other users' data beyond what is necessary to demonstrate the vulnerability; and who give us reasonable time to remediate before any public disclosure.
• With your permission, we will credit you for the discovery.

We do not currently operate a paid bug bounty program.

• Denial-of-service testing;
• Social engineering of Starvy staff or users;
• Physical attacks;
• Reports concerning third-party services we use (please report those to the vendor), unless the issue stems from our configuration;
• Automated scanner output without a demonstrated vulnerability.

For security questions that aren't vulnerability reports: security@starvy.com. For privacy matters, see our Privacy Policy or write to privacy@starvy.com.