How we keep your data safe

This page says what ImprovTeam does today to protect your account and your group's data. It lists things the app really does, not hopes. For what data we hold and why, read the privacy notice.

Signing in

• No passwords. You sign in with a passkey (your phone or computer unlocks it) or with a six-digit code sent to your email. There is no password to guess, reuse or leak.
• Codes are short-lived. A code works for 10 minutes and allows 5 wrong guesses, and we limit how many codes one address or one connection can ask for. We keep only a scrambled (hashed) form of a code, never the code.
• Sessions. You stay signed in for up to 60 days. We keep only a hash of the session token, and its cookie goes to ImprovTeam itself, never to a group's public site.
• Alerts about your account. We email you, and send a push notification if you have a device set up, when someone signs in from a browser we have not seen on your account, when a passkey is added or removed, when recovery codes are used or replaced, when your email address changes (the alert goes to the old address), when bank details change and when account deletion is requested. You cannot switch these alerts off.

Where your data lives

• In the EU. The database and the file storage (photos, logos and backups) are set up in Cloudflare's EU jurisdiction, so they are stored in the EU.
• Who else handles it. A short list of providers process data for us (hosting, email, payments and so on). Each one, what it does and what it receives is in section 5 of the privacy notice, and how data crosses borders is in section 6.

Encryption

• In transit. Every page is served over HTTPS. A plain http address is redirected, and browsers are told to use https only for a year (HSTS), for the main site and every address under it.
• At rest. The database and file storage are encrypted at rest by Cloudflare.
• Encrypted again by the app. Where an organiser stores bank details to show to people who owe them money, the app encrypts them itself (AES-256-GCM, with a key only the Worker holds) before they reach the database. The same goes for the webhook addresses and bot tokens of a group chat link, the payment note on a fee, and the API key an organiser pastes so we can read their Ticket Tailor or TicketSource event list (it is used for nothing else and deleted with the feed or the group). A copy of the database alone cannot read them.
• Tokens are hashed. Sign-in codes, session tokens and the secret part of one-tap links are stored hashed, so a copy of the database does not hold working links or codes.
• Browser protections. Pages carry a strict content security policy, cannot be put inside another site's frame, and send other sites no more than the address's origin when you click away.

Backups

A copy of the whole database is saved every week in private storage in the EU and deleted after 60 days. Only the platform admin can open it. It is encrypted at rest like everything else stored with Cloudflare. If you delete your account you stay in these backups until they expire, and any restore re-applies deletions made since.

Tracking and cookies

We use only the cookies the app needs to work (your sign-in, one-tap links and a remembered city). We set no analytics, marketing or cross-site tracking cookies, and we never sell your data. The only counter of visitors is Cloudflare Web Analytics: it uses no cookies, runs only on public pages and never on signed-in pages. The list of cookies is in section 9 of the privacy notice.

• Photos. Photos you upload lose their hidden details, such as the GPS location and the phone model, before we store them.
• Card details. Card numbers never reach ImprovTeam. Payments are taken by Stripe (a group's own account) or Paddle (a group's paid plan), on their pages, and ImprovTeam never holds or routes anyone's money.

Report a security problem

If you think you have found a weakness in ImprovTeam, we want to hear about it. Please email security@improvteam.com, or use the contact form if you would rather. The same details are in a machine-readable file at /.well-known/security.txt.

What to include

• What you found and where (the page address, or the steps to repeat it).
• What it lets someone do, as far as you could tell.
• How to reach you, if you would like an answer.

We read every report and will reply within 5 working days. We will tell you when it is fixed, and credit you if you want that.

Please

• Do not open, change or download other people's data. Stop as soon as you can show the problem, and use your own test account where you can.
• Do not run load tests or anything that could take the site down, and do not send spam or social-engineering attempts to people.
• Give us a reasonable time to fix it before you share it with anyone.

We do not run a bug bounty, so we cannot pay for reports. We will say thank you.