Security

Finding Horizons implements industry-standard security practices appropriate for a consumer travel application. This page describes our current measures honestly. We do not claim SOC 2 compliance, penetration-test certification, or bank-grade security — those claims would require independent audit and certification that we have not yet completed.

All data transmitted between your device and Finding Horizons servers is encrypted in transit using TLS (HTTPS). We enforce HTTPS on all endpoints. HTTP connections are redirected to HTTPS.

Your data is stored in Supabase PostgreSQL with row-level security (RLS) policies enforced at the database level. RLS ensures that each user can only access their own data — other users cannot query your points, trips, or collections even if they attempted to use the API directly.

All sensitive API keys (Stripe secret keys, the OpenAI key, event provider tokens, Google server-side keys) are stored as environment variables on the server and are never exposed to the client or browser. Only NEXT_PUBLIC_ prefixed variables (which are safe-to-expose identifiers like Maps API keys restricted by domain) are present in the browser bundle.

Payment card details are handled exclusively by Apple, Google, or Stripe depending on where you subscribed. Finding Horizons never sees, stores, or handles raw payment card numbers, CVVs, or bank account details. What we store is which plan your account holds and the identifiers needed to link a purchase back to it. Subscription receipts from the app stores are reconciled by RevenueCat, which does not receive your payment method either.

Entitlement is decided on our servers, never on your device. The app can start a purchase but cannot grant one: after any purchase the app discards the store's local answer and asks our servers what the account now holds. A modified app cannot give itself a paid plan.

The optional one-time identity check is run by Stripe Identity on a page hosted by Stripe, opened in your system browser. There is no identity SDK inside our app. Your identity document and selfie are transmitted to Stripe and never pass through our servers — we do not receive, process, or store the images, the document number, or your date of birth. Stripe tells us pass or fail, and that single outcome is what we store on your profile.

A personal connector key is shown to you exactly once and stored only as a one-way hash. We cannot recover it, display it again, or read it out of a database backup, and neither could anyone who obtained one.

Each key carries an explicit set of capabilities rather than blanket access. The two capabilities that spend our AI budget are withheld unless granted, are rate-limited far more tightly than the rest, and count against a daily cap. Every request a connector makes is authorized against your account and can reach no other traveller's data. Revoking a key ends its access; deleting your account destroys it.

Authentication is handled by Supabase Auth using industry-standard OAuth flows (Apple Sign-In, Google Sign-In) and secure email magic links. We do not store passwords. Session tokens are short-lived and stored in secure, HttpOnly cookies where supported.

Firebase is used only for analytics and App Check (bot protection) — not for authentication. Supabase is the sole authentication system.

We recommend you:

• Sign in with Apple or Google (delegating credential management to your Apple/Google account security settings)
• Enable two-factor authentication on your Apple or Google account
• Sign out of the app when using a shared or public device
• Contact us immediately if you believe your account has been compromised

You can delete your account yourself from Profile → Settings → Delete account. Deletion runs immediately on confirmation — it is not a queued request. A request sent by email instead (if you have already uninstalled) is actioned within 30 days. Encrypted database backups may retain copies for up to 30 days before rolling over; that data is not reachable in the product during that window. See our Delete Your Account page for exactly what is removed and what is kept.

In the event of a security breach that affects your personal data, we will notify affected users as required by applicable law (PIPEDA, Québec Law 25, and applicable US state law requirements). Notification will be provided via email and/or in-app notice.

If you discover a security vulnerability in Finding Horizons, we ask that you report it to us responsibly before public disclosure. Contact us at support@findinghorizons.ca with "Security Disclosure" in the subject line.

We commit to acknowledging your report within 5 business days, and to working with you to resolve confirmed vulnerabilities before they are publicized. We do not currently offer a formal bug bounty programme, but we will publicly credit researchers who responsibly disclose issues if they wish.