How we keep onWard safe.

Security and privacy are the same idea from two angles: your data should be yours, and it should be safe while we hold it for you. We design onWard to collect as little as possible, keep your content on your device by default, and protect everything that does sync. Because we are a small team, security is everyone’s job here — not a silo.

• All communication between the app, website and our servers uses modern TLS so nothing travels in the clear.
• Synced data is encrypted at rest on managed infrastructure in vetted regions.
• Secrets and credentials are stored in dedicated secret managers, never hard-coded or committed.

onWard writes to your device first. If you use it without signing in, your content never leaves the device at all. Sync only happens when you are signed in and connected, and it is scoped to your own account — one person’s data is never mixed with or visible to another’s.

We follow least-privilege: staff and systems get only the access a task requires, and that access is reviewed. Sign-in is protected through secure, standard authentication, and we encourage strong, unique credentials for your account.

Production data access is logged. We do not hand your raw content to anyone inside the company without a clear, documented reason.

Anything you publish — a portfolio or a streak — is explicit and revocable. Share links are private unless you send them, you can revoke any link in a tap, and revocation takes effect immediately. Nothing is made public without you choosing it.

You can export your full history whenever you like and delete your account and content permanently. Deletions are honoured across our systems within 30 days, subject only to narrow legal-retention exceptions.

• Dependencies are kept updated and scanned for known vulnerabilities.
• Infrastructure is monitored, with alerts for suspicious activity.
• Backups are encrypted, tested for restore, and access-controlled.
• Security is part of how we build, not a step bolted on at release.

A lot of security is shared. Please keep your password unique, enable any available device lock or verification, do not share your account, and treat your own share links like anything else you have published. Tell us immediately if you suspect your account is compromised.

Found a weakness? We want to know. Email security@gigslabs.example and we will acknowledge promptly and work with you.

Safe harbour: good-faith research on your own account, without disrupting others or exfiltrating data, will not lead to legal action against you. Please give us reasonable time to fix before disclosing publicly.

If a material breach affecting your data occurs, we will investigate, contain it, and notify affected users and any relevant authorities within the timelines the law requires — no slower than we would want to be told ourselves.

For anything security-related, contact security@gigslabs.example. For how we handle data day-to-day, read our Privacy Policy.