Security
Your data isn't our product. Here's how we protect it, what we don't have yet, and what to do if you find a hole.
Found a vulnerability? Tell us
If you've found a security problem in Dumpli, thank you for telling us first. Write to:
labas@dumpli.app- what the problem is and where (URL, screen or API path);
- how to reproduce it – steps, requests, screenshots;
- what impact it could have (for example, whose data can be reached).
In scope
- dumpli.app – the website
- app.dumpli.app – the app and its API (/api)
Out of scope
- services of other companies we use (Hetzner, Cloudflare, Zoho, Open Food Facts, Apple, Google, Anthropic) – please contact them directly;
- load and DoS testing, spam, social engineering, physical access;
- reports without a real way to exploit them (for example, only a missing header or an automated scanner report).
Good-faith rules
- Test with your own account. Don't view, change or copy other people's data beyond what's needed to show the problem.
- Don't disrupt the service for other people.
- Don't talk about the problem publicly until it's fixed – give us time.
- Delete any data you got by accident and don't pass it on.
What we promise
- We won't take legal action or go to the police against a researcher acting in good faith under these rules.
- We read every report and tell you what we decided.
- Problems that put people's data at risk get fixed first.
Here's the deal: we don't pay money for vulnerabilities (no "bug bounty"). We're a small team and don't want to promise what we can't keep. What we can offer is a sincere thank-you.
Machine-readable contact: /.well-known/security.txt
How we protect data
Secure connections only
The website and the app work over HTTPS only, and we tell browsers to always connect securely (HSTS). Security headers stop, for example, our pages being shown inside other sites' frames.
Encrypted records
The app record (plan, diary, weight and so on) is stored on the server encrypted with AES-256-GCM. The key lives on the same server, so this protects against stolen disks or copies, not against us. We'd rather say that openly.
Passwords
We never store your password – only its scrypt hash with a separate salt per person. Sign-in and password-reset tokens are stored only as hashes too. Sign-in attempts are rate-limited.
The sign-in cookie
The only cookie is the sign-in one. Page scripts can't read it, it's only sent over a secure connection, and other sites can't use it to send data to our server.
What stays on your phone
Health quiz answers never leave the device. Photos stay there too – except "Calories from a photo" and reading a recipe (both Plus), when you choose to send a photo for an estimate or a read. Without an account nothing syncs.
Where and how long
The server is in a Hetzner data centre in Germany (EU). We don't store IP addresses, the website has no third-party scripts, and fonts load from our own site. Deleted data disappears from backups within 14 days.
What we don't have yet
There's no two-factor sign-in (a code on your phone) yet. So use a long password just for Dumpli, and a screen lock on your phone: data on a device is only as safe as the device itself.
More about what we keep and why – in the privacy policy.