Security

Keeping children's and families' information safe matters more to us than anything else we build. If you think you have found a security problem in Jupo World, please tell us.

How to report

Email [PLACEHOLDER: PH-16 security contact address; hello@jupo.world until a security alias exists] with:

• what you found and where (the address, app version or device);
• the steps to reproduce it;
• what an attacker could do with it.

Please do not include real children's or families' data in your report. We aim to acknowledge your report within 1 business day and to keep you updated until it is fixed. Our contact details are also published at /.well-known/security.txt.

In scope

• the website jupo.world and its signed-in areas;
• the game at play.jupo.world;
• the Jupo World apps for iPhone, iPad and Android;
• our servers and the interfaces the apps and website use.

Out of scope

• services run by other companies, such as Apple, Google, RevenueCat or GameAnalytics (report those to them);
• denial of service, load testing or spam;
• social engineering of our staff, partners or families, and physical attacks;
• reports from automated scanners without a demonstrated problem;
• missing best-practice headers or settings with no real impact.

Please

• only test with accounts and data that are yours, and stop as soon as you reach anyone else's information;
• never access, change or keep children's information;
• give us a reasonable time to fix the problem before telling anyone else;
• do not use the problem for anything other than showing it to us.

Our promise

If you follow these rules in good faith, we will not take legal action against you for your research, we will work with you to understand and fix the problem, and, if you wish, we will thank you publicly once it is fixed. We do not run a paid bug bounty.

How we protect your information

• No passwords. Adults sign in to the website with Google, Apple or an email link, so there is no password of ours to steal or reuse.
• Short sign-in sessions. On a shared computer you are signed out when you close the browser or after 15 minutes without activity, unless you choose to stay signed in. Session cookies cannot be read by the page's scripts.
• Extra checks for big steps. Downloading your family's data, removing a child or deleting the account asks you to sign in again first.
• Codes are stored safely. We store our codes in a scrambled form, so a copy of our database would not reveal working codes.
• Limited staff access. Staff see only what they need, and what they do is recorded.
• Data in the European Union for our main database, as our Privacy Policy explains.

If something goes wrong that puts your information at risk, we will tell you and the authorities as the law requires.