Security at Fiyna
Your data
- All traffic between the app and our servers uses TLS encryption.
- Passwords are stored only as salted hashes. One-time codes and invitation tokens are stored hashed and expire.
- Every request is checked on our servers for who you are and which space you may access. The app cannot grant itself access by changing what it sends.
- Sign-in, verification codes and invitations are rate limited to slow guessing attacks.
- Sensitive actions such as member changes and ownership transfers are recorded in an audit log.
Your device
- Session tokens are kept in the iOS Keychain or Android Keystore.
- App Lock: add a 4-digit PIN and, if your device supports it, Face ID or fingerprint. Choose when it relocks: immediately, after 30 seconds, or after 1 minute.
- Your PIN is stored only on your device, as a salted, slow verifier. It is never sent to us.
- Biometric matching is done by your operating system. Fiyna never sees or stores biometric data.
- Forgot your PIN? You must sign in to your account again before it can be reset.
Limits to be clear about
App Lock protects against casual access to an unlocked phone. It is not a substitute for your device passcode and cannot protect data on a compromised, rooted or jailbroken device.
Privacy between spaces
Your Personal Space is never visible to shared-space members. Removing a member ends their access immediately.
Reporting a vulnerability
Email [support email] with the subject “Security”. Please do not access other users’ data or disrupt the service while testing. We will acknowledge your report and work with you on a fix.