SECURITY · EDUCATIONAL APPLICATION
Conventional, privacy-conscious web security.
StudyFlow is delivered over HTTPS using modern browser protections and a small first-party application footprint.
Transport and browser protections
HTTPS is enforced. The site uses modern TLS, HSTS, Content Security Policy, clickjacking protection, MIME-type sniffing protection, a restrictive Permissions Policy and a referrer policy.
Data architecture
StudyFlow is local-first: it can be used without relying on cloud synchronisation. Optional accounts use Firebase Authentication and Cloud Firestore so a planner can be stored privately across supported devices. Firestore access rules limit each account to its own private planner record. The offline cache is limited to the public application shell, not planner data.
Safe product boundaries
StudyFlow does not offer a proxy, VPN, tunnel, remote browser, arbitrary URL fetcher, anonymous relay, public chat or public file-sharing functionality. It makes no behavioural changes for school filters.
Responsible vulnerability disclosure
Security researchers may test only their own account and non-destructive, low-volume behaviour. Do not access another user’s data, alter or delete data that is not yours, disrupt the service, use denial-of-service testing, run automated scans that create significant load, or attempt to bypass access controls. Report a finding through the contact route in security.txt, with a clear description, affected URL or feature, reproducible steps and any safe evidence. Please do not include credentials or student records.
Our response approach
Good-faith reports that follow these boundaries will be reviewed and handled responsibly. StudyFlow will investigate, prioritise a fix where appropriate, and aim to acknowledge the report. This is a limited safe-harbour statement for authorised, non-destructive testing; it does not permit access to systems or data outside your own account.