1. Our security approach
Better You uses layered account, application, database, provider, and operational safeguards. High-risk changes are reviewed and tested before controlled production release, and sensitive credentials remain behind trusted server boundaries.
No online service can promise perfect security. Better You describes concrete current controls and does not claim ISO, SOC 2, GDPR, POPIA, or another certification.
2. User control and approval boundaries
AI-assisted Capture and Universal Intake produce editable suggestions. They do not silently become Tasks, To-Dos, Projects, Calendar events, or saved plans where the product requires review. Calendar selection, write destination, notifications, learned preferences, and connection state remain user-controlled.
3. Account protection and data isolation
Private product routes require an authenticated session. Server APIs derive the account from that session rather than trusting a user identifier supplied by the browser. User-owned records are scoped to the signed-in account through database access rules, ownership filters, and same-user relationship checks.
Authentication and password handling use Supabase Auth. Browser roles do not receive database service credentials or direct authority over protected operational records.
4. OAuth and connected calendars
Google Calendar connections use the provider's authorization flow, explicit scopes, protected request state, and server-derived ownership. Expanded multi-calendar access is an explicit user choice rather than a silent permission change.
Google OAuth credentials are encrypted before application storage and are available only to trusted server code. Better You uses selected calendars for availability and one chosen write destination. Calendar event content is not sent to AI merely for availability planning.
5. AI security and privacy boundaries
Paid AI features pass through one authenticated server gateway. Supported operations have closed names, bounded input and output, timeouts, rate policies, and structured validation. Unsupported operations fail closed.
Provider secrets remain server-side. Rejected authentication, oversized input, exhausted quota, or unavailable distributed limiting prevents the provider call. AI telemetry is content-minimised and excludes raw prompts, raw responses, private titles, notes, reflections, and Calendar content.
6. Rate limits and abuse protection
Better You uses shared limits for paid AI operations, validates input at public and authenticated boundaries, and restricts sensitive server functions to the roles that need them.
Web Push uses approved provider families, bounded retries, per-device delivery identity, quiet hours, deduplication, and independent delivery controls.
7. Monitoring and data minimisation
Better You records bounded status, counts, timing, error categories, scheduler health, delivery state, and content-free security signals needed to detect failures and abuse. Administrative views are protected and minimise user information.
Product analytics uses a closed event vocabulary instead of arbitrary private content. Operational records are designed not to include provider tokens, subscription keys, raw AI exchanges, Calendar narratives, or user reflections.
8. Disconnect, deletion, and service providers
You can disconnect Google Calendar, revoke notification subscriptions, and stop confirmed preferences. Account and data deletion requests are handled through verified support while self-service deletion is being completed. See the Data Rights guide.
Better You relies on established providers for authentication, hosting, AI, Google Calendar, push delivery, and support email. The product limits the information and authority used for each role, while each provider remains responsible for its own infrastructure.
9. Responsible vulnerability reporting
If you believe you found a vulnerability, email support@getbetteryou.live with the subject Security report. Include a concise description, the affected URL or feature, approximate time, and safe reproduction steps. Remove unnecessary personal information and secrets.
Do not access another person's data, disrupt accounts, degrade the service, or use destructive testing. Better You does not currently operate a bug bounty or promise a fixed response SLA. The RFC 9116 contact record is available at /.well-known/security.txt.