Protecting the way home.

• Passwords are hashed with Argon2id. We never store or see them in plain text.
• Web sessions use a random token in an HttpOnly, Secure, SameSite=Lax cookie, and only a SHA-256 hash of the token is stored.
• The mobile app uses a bearer token kept in the phone's secure storage (Keychain or Keystore). Signing out revokes it on the server.
• Every site is served over HTTPS only.

• A care team sees a patient's check-ins only while the patient or main caregiver has sharing switched on. Switching it off removes access straight away.
• Care circle members join only through an invite link the person created, with a clear role.
• Plan codes are single use and expire after 30 days.
• The research view shows only counts and averages, hides any group smaller than 10 people, and logs every view and export.
• Qloo receives only favorite titles, a city point and generic tags. Never a name, email, plan, check-in or warning sign.

• The code is open source, so anyone can review it at github.com/xElvolution/loci.
• Inputs are validated on the server, and every change goes through linting, type checks and automated tests.
• No credentials, keys or server details are kept in the repository. Each deployment reads its configuration from environment variables.
• You can export or delete your data at any time from Settings.

Please do not report security problems in public issues. Use GitHub's private reporting instead: report a vulnerability. Only the maintainers can see it.

Tell us what you found, where, the steps to reproduce it and the impact you expect. We aim to acknowledge reports within 3 business days and to share a plan to fix them within 10 business days, and we credit researchers unless they ask us not to.

Good-faith research is welcome. Use only the demo or accounts you created, never access or keep someone else's data, stop as soon as you reach personal information, and give us reasonable time to fix the issue before you disclose it. The full policy is in SECURITY.md.