Overview
Crimson is operated by Driftline Ventures LLC ("we", "our", "the company"). Menstrual and reproductive health data is among the most sensitive information a person can share, so security is part of how the app is designed, not a feature added later. This page describes how we protect your data, how to report a security vulnerability to us, and what you can expect when you do. It supplements our Privacy Policy and Terms of Use.
Reporting a Vulnerability
If you believe you have found a security issue in the Crimson app, this website, or the backend they connect to, please tell us before telling anyone else. Email support@getcrimson.app with "Security" in the subject line. A machine-readable version of this contact is published at /.well-known/security.txt.
Helpful reports include:
- The product and version affected (app build, or a page URL)
- Steps to reproduce, or a proof of concept
- What an attacker could achieve, in your assessment
- How you would like to be credited, if at all
We will acknowledge your report within three business days, keep you informed as we investigate, and tell you when the issue is fixed. We do not currently run a paid bug bounty program. With your permission, we are glad to credit you publicly once a fix has shipped.
Safe Harbor for Good-Faith Research
We consider security research conducted under this policy to be authorized, and we will not pursue or support legal action against you for it. Where our Terms of Use prohibit interfering with the Service, research that follows the rules below is not a violation. To stay within this policy:
- Test only against accounts you own or have explicit permission to use. Never access, modify, or delete another person's data.
- If you encounter personal or health data that is not yours, stop, do not save or share it, and tell us what you saw.
- Do not degrade the Service. Denial-of-service testing, automated high-volume scanning, and spam are out of scope.
- Do not use social engineering, phishing, or physical attacks against our staff, users, or infrastructure.
- Give us a reasonable time to fix the issue before disclosing it publicly. We ask for 90 days from your first report, and we will work with you on a shorter timeline where a fix ships sooner.
If you are unsure whether something is covered, ask us first.
Scope
In scope: the Crimson iOS and Android apps, the getcrimson.app website, and the backend API the app and site connect to.
Out of scope: vulnerabilities in third-party services we use, including Clerk, Convex, Vercel, Sentry, Brevo, OpenRouter, Apple, and Google. Please report those to the provider directly. Findings that only affect users of outdated operating systems or browsers, or that require a jailbroken or rooted device, are generally low priority. Reports about missing best-practice headers with no demonstrated impact are welcome but will be handled as improvements rather than vulnerabilities.
How We Protect Your Data
Authentication: Sign-in is handled by Clerk. We never see or store your password. Every backend function verifies the identity of the signed-in account on the server before reading or writing anything, and each record is scoped to the account that created it, so a request can only reach its own data.
Encryption: All traffic between the app, the website, and our backend uses TLS 1.2 or later. Cloud data is encrypted at rest by our database provider. It is not end-to-end encrypted: like most cloud services, our systems can technically access stored data, and we do so only for the purposes described in the Privacy Policy.
App Lock: You can require Face ID, Touch ID, or your device passcode every time Crimson opens, so an unlocked or borrowed phone does not expose your history. Crimson never invents its own PIN; it relies on the authentication built into your device. Optional biometric sign-in stores your credentials only in the iOS Keychain or Android Keystore, and is off unless you enable it in Settings.
AI features: Messages to the AI assistant never go directly from your device to a model provider. They pass through our backend, which holds the provider credentials, applies a safety prompt, and enforces a per-user daily limit. The app asks for your explicit permission before any data is sent, and you can withdraw it at any time. Which providers we use, and what they retain, is described in the Privacy Policy.
Secrets: API keys and other credentials live in server-side environment variables. They are not shipped inside the app.
Crash reporting: Release builds send crash reports to Sentry with personally identifying data disabled and an additional scrubbing step before anything leaves the device. Reports never include your name, email, account identifiers, or health data.
No trackers: The app and website contain no advertising SDKs and no third-party analytics trackers. There are no advertising identifiers or precise-location data in our systems to lose.
Website: getcrimson.app is served over HTTPS only, with content-type sniffing disabled, framing by other sites blocked, and a strict referrer policy.
Deletion: You can delete your account and cloud data at any time from the app or by following the steps on our account deletion page. What survives deletion, and why, is spelled out in the Privacy Policy.
What You Can Do
- Turn on App Lock in Settings, especially if other people handle your phone.
- Use a strong, unique password for your Crimson account, ideally from a password manager.
- Keep your phone's operating system and the Crimson app up to date.
- If you notice sign-ins or changes you do not recognise, change your password and contact us immediately.
If Something Goes Wrong
If we confirm a security incident that affects your data, we will notify affected users by email without undue delay, explain what happened and what we are doing about it, and meet any notification obligations that apply under the law of your jurisdiction.
Changes to This Page
We will update this page as our practices change and refresh the "Last updated" date above. Material changes to how we protect your data will also be reflected in the Privacy Policy.
Contact Us
Security reports and questions: support@getcrimson.app.