Security
How Chillswitch protects data, where the boundary ends, and how to report a problem.
Chillswitch is operated by Modernaut LLC. Security is a process, not a guarantee. This page describes the current architecture and a good-faith reporting path; it does not promise that the service is invulnerable.
Current protections
Transport encryption for app and website connections.
Client-side sealing of in-app alert content before it reaches the service.
Signed in-app alerts and all-clears, with visible unverified state when validation fails.
Hardware-backed device key wrapping where supported, with truthful fallback reporting.
Encrypted sensitive database fields and keyed hashes for matching without routine plaintext lookup.
Rate limits, account blocking, delivery-state tracking, dead-letter handling, and minimal hashed safety audit events.
Important boundaries
The server cannot read sealed in-app alert content, but it does process account relationships, schedules, routing, delivery, network, consent, billing, and security metadata. SMS is not end-to-end encrypted and is visible to Modernaut, Twilio, carriers, and recipient devices. An unlocked or compromised device may expose keys and visible data. No notification channel is guaranteed.
Report a vulnerability
Email [email protected] with a concise description, affected URL or app version, reproduction steps, impact, and a safe way to contact you. Do not include real recovery codes, private keys, phone numbers, purchase tokens, location, or another person’s content.
Good-faith research
Use synthetic accounts and the minimum testing needed to demonstrate an issue. Do not access another person’s data, use social engineering, perform denial-of-service or high-volume testing, degrade check-in or alert delivery, send non-consensual SMS, evade rate limits, retain data, or publicly disclose an unresolved issue before Modernaut has had a reasonable opportunity to investigate.
When research is conducted in good faith within these boundaries, Modernaut does not intend to recommend legal action solely for that research. This statement does not authorize unlawful conduct, bind third parties, provide a bug bounty, or waive rights regarding privacy violations, extortion, data destruction, or service disruption.
Response and disclosure
We will acknowledge and triage reports as operational capacity allows, prioritize by user impact, and coordinate remediation and disclosure in good faith. We do not promise a fixed response or remediation time. For urgent exposure of real user data, state that clearly in the subject without including the data itself.
Other information
Read the Privacy Policy for data handling and Know the limits for delivery and device limitations.