1. How your data is protected
- In transit: everything runs over HTTPS/TLS. The app, the website, share links, and custom domains all use certificates we manage.
- At rest: captures are stored in object storage with server-side encryption; the database is encrypted at rest.
- Passwords: hashed with a slow, salted algorithm. We cannot read them, and a database leak would not reveal them directly.
- Uploads: the app uploads straight to storage using a short-lived pre-signed URL, so bytes never pass through a system that doesn’t need them.
- Share links: served from our edge layer by short random code. Storage credentials are never exposed to the browser.
- Access control: production access is limited to those who need it and is audited.
2. What share links are, and aren’t
Share links are unlisted, not encrypted or password-protected. Anyone holding a link can view that capture. Codes are random and long enough that enumeration is impractical, but you should treat a link as semi-public.
For anything sensitive, set a self-destruct expiry or delete the capture when you are done. We do not currently offer end-to-end encryption or password-protected links. If that matters to you, tell us, because it affects what we build next.
3. Reporting a vulnerability
Email security@wacdum.com with steps to reproduce and what you believe the impact is. Please give us a reasonable chance to fix it before publishing.
What we promise researchers who follow this policy:
- We acknowledge reports within 3 working days.
- We keep you updated on progress and tell you when it’s fixed.
- We will not pursue legal action for research that follows this policy.
- We are happy to credit you publicly if you would like that.
Please do not: access other people’s data, degrade the service, run automated scans that generate heavy load, or use social engineering against our staff or vendors.
4. If something goes wrong
If a breach affects your personal data, we will notify affected users and the relevant regulator without undue delay, and within 72 hours of becoming aware where the law requires it. We will tell you what happened, what data was involved, and what to do about it.
5. Your part
- Use a strong, unique password.
- Keep your Mac and browser updated.
- Review what is in a capture before you share the link.
- Delete captures you no longer need.