App-owned security notice

Security practices

Last updated: August 9, 2026

What this page is

This is Simply Mindfull Moments's own description of how the app behaves today. It is not a certification, an audit result, an independent assessment, or a guarantee against every possible attack. We describe only what the product actually does, and we update this page when that changes.

Your records are scoped to your account

Mood check-ins, journal entries, reminders, bookings and orders are stored against your account and returned only to that account.
Access rules are enforced in the database itself, not just in the app screens, so a request for someone else's row returns nothing.
Traffic between your browser and Simply Mindfull Moments is served over HTTPS.

Account protections

Sign-up requires a working email address and a confirmation click before the account is usable.
You can sign in with email and password or with Google.
Sensitive account actions — changing privacy settings, exporting data, deleting the account — are blocked until your email is confirmed.
Password resets are done through a one-time link sent to the address on the account.

Organization reporting cannot reach individuals

Joining an organization is optional and contributing to its reports is a separate opt-in you can withdraw.
Reports are produced by protected database functions that return group totals only — never a check-in, a journal entry, a note or a member list.
Nothing is shown unless at least 25 opted-in members contributed to that exact selection.
Only an existing administrator can grant access, and every report view and export is written to an access log.

Controls you hold yourself

Export everything Simply Mindfull Moments holds about you as a machine-readable file.
Delete your account, which removes your entries, usage records and device data.
Set marketing and processing choices in the consent center; Global Privacy Control signals are honored automatically.
Your emergency plan and any entries written before you sign in stay on your device and are never uploaded.

Reporting a vulnerability

If you believe you have found a security issue, email us with steps to reproduce it and what you were able to access. We aim to acknowledge reports within three business days and to tell you what we plan to do about it.

Please do not run automated scanning against live accounts, do not access or modify data belonging to anyone else, and do not publish details before we have had a chance to fix the issue. We will not pursue action against good-faith research that follows those limits.

security@simplymindfullmoments.org

If something goes wrong

If unauthorized access to identifiable health-related data occurs, we will notify affected users and applicable regulators without unreasonable delay, and describe what happened, what data was involved and what to do next. The legal framing for that data is explained in the HIPAA readiness checklist.