Technical security details

Updated October 8, 2026

We collect limited information and use several layers of protection for family profiles, photos and messaging. This page describes implemented safeguards supported by our recorded security checks.

Limited identifying information

First names or nicknames are enough. Last names and home addresses are not required to set up love notes. For added security, please keep interests general, such as “soccer” or “drawing,” and leave out identifying information like school or team names and locations.

Phone numbers, account email, birthdays and anything you choose to add still deserve protection. This service does not make profiles anonymous.

Account and database access

• Supabase handles account sign-in. Database row-level security (RLS) and ownership checks restrict family records to the account authorized to access them.
• Related profiles, recipients and saved content are linked with ownership constraints to prevent cross-account access.
• Session checks restrict access after global sign-out or password-reset session revocation.
• Administrative service credentials remain on the server. Sensitive service operations are restricted from ordinary browser accounts.

Private photos

• Family photos use private storage with account ownership and session checks.
• Authorized viewing uses temporary signed links rather than public photo listings. A shared link can remain usable until it expires.
• Uploads and image processing have file-size, file-type and resource limits. Unreferenced photo cleanup includes ownership, age and reference checks.

Permission and text-message safeguards

• Each loved one has an independent permission record. Approval for one child does not approve another.
• Children under 13 receive Love Notes through an approved caregiver. For teens, the caregiver chooses the approved delivery option.
• Consent, withdrawal and STOP suppression are checked before sending Love Notes. A STOP request does not automatically delete account records.
• Incoming messaging-provider events are checked using digital signatures and timing checks. Duplicate events and uncertain send outcomes have handling safeguards.
• Permission requests and selected media operations have server-enforced request limits to reduce abuse.

Encryption and hosting firewall

• Encrypted connections: HTTPS/TLS protects information as it travels between your browser, our website and our database service. The website also sends an HSTS header telling compatible browsers to keep using HTTPS.
• Encryption while stored: Supabase, our database and private-photo provider, documents AES-256 encryption at rest for customer data. This protects the underlying stored data; account permissions still control who can use it through the service.
• Hosting firewall and attack protection: Vercel provides a platform-wide firewall and automatic protection against distributed denial-of-service (DDoS) attacks, which try to overwhelm websites with traffic. These are included hosting protections; we do not claim that a separate custom firewall ruleset has been configured.

Provider details: Supabase security and Vercel security. These describe provider-managed safeguards, not an independent certification of Love, Grandma.

Browser and server safeguards

• The website uses HTTPS to protect information in transit between your browser and the website.
• Browser security headers restrict embedding the site in other pages, content-type guessing, referrer sharing and access to camera, microphone and geolocation.
• A Content Security Policy restricts executable scripts and network destinations. Page scripts use a fresh, random authorization value for each page request.
• Page responses and API responses are marked to prevent shared caching of account-related information.
• Server request handling includes authentication checks and bounded request sizes and processing times.
• Website hosting is provided by Vercel; account data and private photos by Supabase; text delivery by Telnyx and mobile carriers.

We describe specific protections rather than claiming a particular custom firewall configuration or security certification.

Verification and ongoing care

Our October 8, 2026 review included dependency updates, automated security regression checks, staged cross-account access attempts and read-only inspection of database and storage protections. No known production dependency vulnerabilities were reported by the dependency audit after the updates. This is a dated check, not a promise that vulnerabilities cannot emerge later.

Recorded checks include staged attempts to access another account’s records, restricted-operation checks and scoped Production configuration and endpoint checks. These checks cover specific protections; they are not an independent penetration test or a guarantee against every attack. Security reviews, software maintenance and recovery planning remain ongoing work.

Standard SMS is not end-to-end encrypted. Messaging providers and carriers process phone numbers and message content to deliver texts. Deletion requests also have limits for required consent and opt-out records, provider logs and backups.

For the full explanation of information use, providers and deletion choices, read our Privacy Policy. Questions or concerns? Contact lovegrandmahq@gmail.com.