Security

Last updated: September 2026

FamilyShield is built with security-first engineering. This page describes the protections actually implemented in the app — and what you can do to keep your own account safe.

1. Authentication

• Signed sessions: sign-in issues a short-lived JWT token that must accompany every API request.
• Password hashing: passwords are hashed with Argon2 and are never stored or logged in readable form.
• Google sign-in: optional OAuth login handled through Google's own secure flow — we never see your Google password.
• Sign out everywhere you can: signing out clears the session token from that browser.

2. Passwords and account recovery

• Change your password at any time from your profile.
• If you forget it, the reset flow emails you a single-use link — reset links expire and cannot be reused.
• Never share your password, OTPs, or reset links with anyone, including family members.

3. Data in transit

In production the app is served over HTTPS, so traffic between your browser and the server is encrypted with TLS. Family chat uses a secure WebSocket connection tied to your signed-in session.

4. Family chat privacy

• Chat history and live messages are scoped to your family group only — membership is verified before anything is served.
• Only members of a family can open its chat or receive its messages.
• Invite links and codes grant access to your family group, so share them only with people you trust.

5. Notifications

Push notifications use the Web Push standard with VAPID keys, so alerts can only be sent by this application's server to devices you explicitly subscribed.

6. What you can do

• Use a strong, unique password for FamilyShield.
• Keep family invite codes and QR codes private — anyone with the code can request to join.
• Sign out on shared or public devices.
• Keep your browser up to date so TLS and Web Push protections stay current.
• Never paste passwords, OTPs, PINs, or banking details into chat or Ask Shield.

7. Responsible disclosure

If you discover a security vulnerability, please do not exploit it or access other users' data. Report it through the app's support channels with a description and steps to reproduce, and give us reasonable time to fix it before any public disclosure.

8. Data and privacy

For what data is collected and how it is handled, see our Privacy Policy.