Reporting a security problem
Family Cycle holds period dates for families, including children. If you've found a way to see or change data that isn't yours, we want to hear about it first.
How to report
Email security@familycycle.app with what you found, how to reproduce it, and what someone could do with it. Plain text is fine. A person reads every report.
What's covered
- The Family Cycle iPhone app
- The service the app uses to store a family's data
- This website and floodstagellc.com
What we ask
- Use only accounts and families you created yourself, and stop as soon as you can see someone else's data.
- Don't keep, share or change anything that belongs to another person.
- Give us a fair chance to fix the problem before you tell anyone else.
- No denial-of-service testing, and no social engineering of anyone.
What you can expect
We'll confirm we've received your report within 3 business days and keep you updated until it's fixed. If you'd like, we'll thank you publicly once it is.
Safe harbour
If you make a good-faith effort to follow this page, we'll consider your research authorized, we won't pursue or support legal action against you over it, and if anyone else does, we'll say that we authorized it. This covers only systems Flood Stage LLC controls. It can't authorize testing of Google's or Apple's own systems, or access to anyone else's data.
The machine-readable contact file is at /.well-known/security.txt.