Security and privacy
What protects your apps and your data, as it is built today. No outside firm has audited us yet; this page lists what we actually do.
On every app, today
- Content Security Policy
- Trusted Types
- HTTPS only
- Own address per app
- Never embedded
- No passwords
Every app on its own
Each app you make lives at its own web address. The browser keeps its storage, cookies and sign-in apart from every other app, including other apps of yours.
A strict policy on every page
Every app page runs under a strict Content Security Policy: it may load only its own code, nothing from elsewhere, over HTTPS only. Apps built from free-form code also run under Trusted Types, so a script cannot write arbitrary HTML into the page. Policy violations are reported back to us.
The builder is locked the same way
hashdag.ai itself ships a strict policy with every script hashed, HTTPS enforced, and a rule that no other site may embed it. The only page that may be framed is the live preview, and only by the builder.
No passwords to leak
You sign in with Google, with Apple, or with a six-digit code sent to your email. We never store a password, so there is none to steal.
Your data, your call
App data is encrypted and is never used to train models. Only the people you invite can open a shared app, and you can remove anyone at any time. Export everything, or delete it, from your settings.
Made safe for children
A child joins a shared app with a simple profile and no email. Accounts of people under 18 need a parent’s consent and carry extra protections.
Payments stay with the payment provider
Card details go to our payment provider, never to us. We see what plan you chose, not your card.
Reports are read by people
Every app carries a link to report it. Reports reach a review queue, and an app that breaks the rules can be suspended at once. How we handle notices is set out on the Digital Services Act page.
Found something?
If you think you have found a security problem, write to [email protected] with “Security” in the subject. We reply on weekdays, within 24 hours, and we do not go after people who report in good faith.