Security Policy

Account Protection

Hafiz hashes password credentials and uses session cookies for signed-in access. Social sign-in is handled through provider OAuth flows.

Your Responsibility

Use a strong password, keep your email account secure, and sign out on shared devices.

Reporting Issues

If you believe you found a security issue, report it privately with steps to reproduce and avoid accessing data that is not yours.

Limitations

No online service can guarantee perfect security. Hafiz aims to keep data access scoped to authenticated users and minimize unnecessary data exposure.