Security

Last updated: October 23, 2026

The best protection is not having data in the first place. Guests are never saved, and for children we keep only a nickname, a grade band and practice results, and only when a parent chooses to.

How we protect data

• Encrypted connections: the whole site is served over HTTPS only, with HSTS so browsers never fall back to plain HTTP.
• Database rules on every table: row-level security means a signed-in parent can only ever read or change rows that belong to their own account. The website server uses a limited public key, never an admin key.
• Passwords: stored only as salted hashes by our sign-in provider (Supabase Auth). We can't see them.
• Answers checked on the server: puzzle answers are never sent to the browser ahead of time, and saved results are worked out on the server, not trusted from the browser.
• Abuse protection: sign-in, sign-up, email sending and the waitlist are rate limited. The counters store only a keyed hash, never your IP address or email.
• Browser protections: a strict Content Security Policy (no third-party scripts at all), clickjacking protection, and no camera, microphone or location access.
• No trackers: no advertising or analytics scripts, so no third party sees what children do here.
• Careful logging: our error logs record what failed, not who you are: no emails, nicknames or answers.
• Encryption at rest: our hosting (Vercel) and database (Supabase) providers encrypt stored data. We don't claim any certification of our own.

Report a security problem

If you think you've found a vulnerability, please email security@kidorizon.com (this mailbox is still being set up, so messages may not arrive yet). Include the page or address, what you did, and what you saw. We will acknowledge your report, keep you updated, and credit you if you'd like.

While testing, please:

• only use accounts you created yourself, and never access, change or delete anyone else's data;
• avoid anything that could disrupt the site for families (no denial-of-service, spam or heavy automated scanning);
• give us reasonable time to fix the problem before sharing details publicly.

We won't pursue or support legal action against anyone who follows these guidelines in good faith. We don't run a paid bug bounty. Machine-readable contact details are in /.well-known/security.txt.

More

See what we collect on the privacy page, and how to see or delete it on Parents' rights.