Security

How we protect your account and your data, what is not done yet, and how to tell us about a problem.

Your account

Passwords are stored scrambled (bcrypt), never as the password itself.
Sign-in tries are limited per account, so a password cannot be guessed by trying again and again.
Two-step sign-in, if you switch it on: after your password, the 6-digit code from an authenticator app (Google Authenticator, Microsoft Authenticator, Authy, Aegis…). No phone number, no text messages. Ten backup codes for a lost phone, and an email to you whenever it is switched on or off.
Sign-up, invites, messages, reactions and friend requests all have a speed limit.

Your data

Everything between your device and us travels encrypted (HTTPS).
Our database host encrypts the disks the data is stored on.
A key you add (like an AI key) is encrypted again before it is stored (AES-256-GCM).
A photo loses its hidden data (where it was taken, the phone that took it) when it is uploaded.
Messages are not end-to-end encrypted: who can read them.

Not done yet

No outside security audit yet. When one is done, it will be listed here.
No paid bug bounty. Reports are welcome and answered, below.

Report a security problem

Write to yourva@myva.cc. We answer within two business days. Our contact details are also at /.well-known/security.txt.

We will not take legal action against good-faith research that:

does not read, keep or share other people’s data beyond what shows the problem;
does not destroy data or interrupt the service;
gives us a fair chance to fix it before telling anyone else.

If something goes wrong

If a security problem affects your personal data, we tell the people affected without delay: what happened, what was involved, what we are doing and what you can do.

Questions

How do I report a security problem?

Email yourva@myva.cc. We answer within two business days, and we will not take legal action against good-faith research.

Has MySquare had an outside security audit?

Not yet. When one is done, it will be listed on this page.

Is there two-step sign-in?

Yes, if you want it. Switch it on in Settings: after your password, you type the 6-digit code from an authenticator app such as Google Authenticator. No phone number needed.