Security policy
How we protect these websites and how to report a vulnerability.
How we protect data
Traffic is encrypted with HTTPS. Access to data is restricted by server-side rules and limited to the people who need it. Passwords are managed by Firebase Authentication and card details by Stripe, so we do not hold either. ELO and paid features are checked on the server rather than trusted from the browser.
Reporting a vulnerability
If you find a vulnerability, write to contact@obliviondh.com with enough detail to reproduce it. Give us reasonable time to fix it before publishing anything, avoid accessing other people's data, and do not disrupt the service. We will not take action against good-faith research that follows these rules.
Security incidents
If an incident affects your personal data and poses a risk to you, we will notify you and the competent authority as the GDPR requires.
Active incidents for clients
To report an active security incident, use the emergency form at obliviondh.com/contact.