Data Security · Ahsan Mahmood
The measures protecting data here, stated at the level they can actually be verified.
Overview
This page sets out the security measures in place for the website and the app. It is written to be checkable: every claim below is something an outside observer could confirm.
The practices follow the GDPR and comparable regimes. Note the wording — follow, not *certified against*. No audit has been performed and none is claimed.
Security measures
| Measure | What it means |
|---|
| Encryption in transit | Everything between your device and the servers travels over HTTPS with TLS 1.3. |
| Postgres row-level security | Database access is governed by rules, not by application code. Public content is read-only; every write is scoped to its owner. |
| Authenticated administration | The admin panel is behind Supabase Auth (Google sign-in) and is reachable by two fixed addresses. |
| Data minimisation | Only what a feature needs is collected. No unnecessary personal information is requested anywhere on the site. |
Data protection
Data at rest sits in managed Postgres hosted by Supabase and inherits its encryption; the static site itself is served from Firebase Hosting. Access is limited to the site owner. Every list query is bounded, so no single request can pull an entire table.
Third-party security
Security depends on the providers named in the privacy policy — Google, Microsoft, Amplitude, Sentry, OneSignal and FilesHub. Each publishes its own security documentation, and this site’s posture is bounded by theirs.
Your side of it
- Keep the account you sign in with secure — this site never sees that password.
- Sign out on shared devices.
- Keep your browser and operating system current.
- Report anything that looks wrong.
Incident response
If a breach affecting personal data occurs, affected people are notified within 72 hours of it being discovered, along with what was exposed and what to do about it. Supervisory authorities are notified where the law requires.
Compliance
Practices are built around the GDPR, the CCPA and the Play Store data-safety requirements. No third-party certification is held, and none is claimed — a badge saying otherwise would be exactly the unverifiable claim this document is written to avoid.
https://aoneahsan.com/data-security