• Passwordless magic-link authentication and session handling are provided through Supabase Auth.
• The production site uses HTTPS on pergrn.com.
• Supabase Row Level Security limits project and account data by user identity and accepted project membership.
• Shared-project notes and links use access-controlled Supabase persistence and realtime channels.
• Vercel and Expo tokens are submitted to server actions, stored in tables with no browser-client access policies, and are not shown again by the application after connection.
• The tracked application contains no advertising scripts or product analytics integration.

Project owners and accepted members can access the project they share. Collaborators can see and edit project metadata, notes, and links, and can see the emails and live presence of people attached to that shared project. Owners control invitations and project deletion.

Treat each project invite as access to its working context. Revoke people who no longer need access and avoid placing unrelated secrets in a shared project.

Project content is not cached offline: notes and links load from the server and edits require a connection. Versions before September 2026 kept an offline copy in browser IndexedDB, and a copy left behind by such a version remains until site data is cleared.

Theme and card-view preferences are stored locally. On a shared or managed device, sign out and clear site data when appropriate.

Uploaded project logos and banners are stored in publicly readable Supabase buckets. Anyone with an object URL can retrieve the image. Never use those uploads for credentials, confidential screenshots, personal documents, or other sensitive material.

Removing the image reference from a project does not currently prove that every underlying storage object was removed. Email trolz@hey.com if a public object needs explicit removal.

Vercel and Expo tokens are used server-side to validate the connection and retrieve deployment or build information. They are stored as restricted database fields; pergrn does not currently add a separate application-level field-encryption layer.

• Create a token with the minimum practical permissions.
• Do not paste a token into project notes, feedback, or support email.
• Disconnect the integration in Settings when it is no longer needed.
• Revoke the token at Vercel or Expo if you suspect compromise.

User-started research sends the research name, brain dump, search context, and generated findings through Vercel AI Gateway to Anthropic and OpenAI. Optional integrations send requests to Vercel or Expo. These providers have their own security and retention practices.

Do not place access tokens, passwords, confidential customer data, or highly sensitive personal information in AI research inputs.

• Protect access to the email account that receives magic links.
• Review project collaborators and connected integrations regularly.
• Keep independent copies of information you cannot afford to lose.
• Use browser/device security appropriate to the sensitivity of your projects.
• Do not store production credentials in notes or environment-notes fields.

Email trolz@hey.com with a clear description, affected route or feature, and safe reproduction steps. Do not access other users' data, disrupt the service, or include live credentials or unnecessary private content.

Reports are reviewed as soon as reasonably practical. The beta does not currently offer a formal bug bounty, guaranteed response time, or incident-response SLA.

This page describes controls visible in the current implementation. It is not a claim of SOC 2, ISO 27001, PCI DSS, HIPAA, or another certification, and no internet service can guarantee protection from every threat.