Security

We never store your password. It is put through bcrypt, a deliberately slow one-way hash, and only the result is kept. Nobody at SnapVitals can read your password, and a stolen database would not reveal it.

Sign-up and password reset enforce the same complexity rules, so a reset can never weaken an account below what registration demands. Changing your password signs out every other device.

Failed sign-ins take the same amount of time whether or not the email exists, so response timing cannot be used to discover which addresses are registered.

Signing in issues a short-lived access token and a longer-lived refresh token. Refresh tokens are stored only as hashes, and each purpose, session, password reset, email confirmation, uses a separately namespaced hash, so a token minted for one flow cannot be replayed against another.

Confirmation and reset links are single-use and expire.

All traffic is over HTTPS with a certificate that renews automatically. The database and cache are reachable only from the application server itself, they are not exposed to the internet.

Everything you can see is scoped to your own account at the database query level, not merely hidden in the interface, so another user cannot reach your meals by guessing an address.

Sign-in, registration, password reset and AI analysis are all rate limited. Accounts must confirm their email address before they can sign in, which keeps invented addresses from consuming paid AI capacity.

Administrative access is restricted to a specific address list enforced on the server. Hiding an admin link in the interface is not treated as security.

If you find a security problem, please tell us before telling anyone else. Email hello@snapvitals.app with enough detail to reproduce it. We will acknowledge within 72 hours and keep you updated until it is fixed.

We will not pursue legal action against anyone who reports a genuine issue in good faith, provided you do not access, change or delete data belonging to other people, do not degrade the service for others, and give us reasonable time to fix it before publishing.

We are too small to pay bounties. We will credit you if you would like to be credited.

If a breach affects your personal data, we will notify you and the Data Protection Board of India as the Digital Personal Data Protection Act, 2023 requires. We will tell you what happened, what data was involved, and what to do about it, without waiting until we have a comfortable explanation.

• Use a password you do not use anywhere else
• Confirm your email address so you can recover the account
• Sign out on shared devices
• Remember you can log meals by typing instead of photographing - that path never sends an image anywhere