Perfect Timing
Security
Security is a core part of building an exact-time reminder platform users can trust.
This starter policy is provided for product launch preparation and should be reviewed by a qualified legal professional before public launch.
Security Overview
Perfect Timing is designed with secure authentication, private reminder data, verified payment notifications, and careful handling of optional notification services.
Password Hashing
Passwords are hashed with bcrypt before storage. Plaintext passwords are never stored.
Secure Sessions
Sessions use signed HTTP-only cookies with same-site controls and secure cookies in production.
Payment Security
Perfect Timing does not store card numbers, card security codes, or sensitive payment method details.
ClickBank Payment Processing
ClickBank handles checkout, payment collection, receipts, rebills, refunds, cancellation events, and affiliate attribution. Perfect Timing stores only the billing metadata needed to manage plan access.
Push Notification Security
Push subscriptions are stored only to deliver reminders and test notifications. VAPID keys must be managed through environment variables.
Data Access Controls
Dashboard and API routes require authenticated users, and reminder operations check ownership before reading or modifying data.
Reporting Security Issues
Send security concerns to security@example.com with the subject Security Report. Include reproduction steps and impact where possible.
Limitations
No service is perfectly secure. Operators should add monitoring, backups, incident response processes, and periodic security reviews before large-scale production launch.