Overview

Crimson is operated by Driftline Ventures LLC ("we", "our", "the company"). Menstrual and reproductive health data is among the most sensitive information a person can share, so security is part of how the app is designed, not a feature added later. This page describes how we protect your data, how to report a security vulnerability to us, and what you can expect when you do. It supplements our Privacy Policy and Terms of Use.

Reporting a Vulnerability

If you believe you have found a security issue in the Crimson app, this website, or the backend they connect to, please tell us before telling anyone else. Email support@getcrimson.app with "Security" in the subject line. A machine-readable version of this contact is published at /.well-known/security.txt.

Helpful reports include:

We will acknowledge your report within three business days, keep you informed as we investigate, and tell you when the issue is fixed. We do not currently run a paid bug bounty program. With your permission, we are glad to credit you publicly once a fix has shipped.

Safe Harbor for Good-Faith Research

We consider security research conducted under this policy to be authorized, and we will not pursue or support legal action against you for it. Where our Terms of Use prohibit interfering with the Service, research that follows the rules below is not a violation. To stay within this policy:

If you are unsure whether something is covered, ask us first.

Scope

In scope: the Crimson iOS and Android apps, the getcrimson.app website, and the backend API the app and site connect to.

Out of scope: vulnerabilities in third-party services we use, including Clerk, Convex, Vercel, Sentry, Brevo, OpenRouter, Apple, and Google. Please report those to the provider directly. Findings that only affect users of outdated operating systems or browsers, or that require a jailbroken or rooted device, are generally low priority. Reports about missing best-practice headers with no demonstrated impact are welcome but will be handled as improvements rather than vulnerabilities.

How We Protect Your Data

Authentication: Sign-in is handled by Clerk. We never see or store your password. Every backend function verifies the identity of the signed-in account on the server before reading or writing anything, and each record is scoped to the account that created it, so a request can only reach its own data.

Encryption: All traffic between the app, the website, and our backend uses TLS 1.2 or later. Cloud data is encrypted at rest by our database provider. It is not end-to-end encrypted: like most cloud services, our systems can technically access stored data, and we do so only for the purposes described in the Privacy Policy.

App Lock: You can require Face ID, Touch ID, or your device passcode every time Crimson opens, so an unlocked or borrowed phone does not expose your history. Crimson never invents its own PIN; it relies on the authentication built into your device. Optional biometric sign-in stores your credentials only in the iOS Keychain or Android Keystore, and is off unless you enable it in Settings.

AI features: Messages to the AI assistant never go directly from your device to a model provider. They pass through our backend, which holds the provider credentials, applies a safety prompt, and enforces a per-user daily limit. The app asks for your explicit permission before any data is sent, and you can withdraw it at any time. Which providers we use, and what they retain, is described in the Privacy Policy.

Secrets: API keys and other credentials live in server-side environment variables. They are not shipped inside the app.

Crash reporting: Release builds send crash reports to Sentry with personally identifying data disabled and an additional scrubbing step before anything leaves the device. Reports never include your name, email, account identifiers, or health data.

No trackers: The app and website contain no advertising SDKs and no third-party analytics trackers. There are no advertising identifiers or precise-location data in our systems to lose.

Website: getcrimson.app is served over HTTPS only, with content-type sniffing disabled, framing by other sites blocked, and a strict referrer policy.

Deletion: You can delete your account and cloud data at any time from the app or by following the steps on our account deletion page. What survives deletion, and why, is spelled out in the Privacy Policy.

What You Can Do

If Something Goes Wrong

If we confirm a security incident that affects your data, we will notify affected users by email without undue delay, explain what happened and what we are doing about it, and meet any notification obligations that apply under the law of your jurisdiction.

Changes to This Page

We will update this page as our practices change and refresh the "Last updated" date above. Material changes to how we protect your data will also be reflected in the Privacy Policy.

Contact Us

Security reports and questions: support@getcrimson.app.