Account access
Supabase Auth handles sign-in. Saved workspace data is tied to a signed-in account, and database row-level security policies restrict access to the owning user. Contact messages are stored in a private table without public read access.
Data protection
Supabase provides encrypted connections and encryption at rest for its hosted database. Server credentials and AI provider keys are kept server-side. We use access checks in application code as well as database policies for account data.
AI and analytics
When you request AI help, the relevant text is sent to OpenRouter and the selected model provider. We do not send note or task text to PostHog. Optional analytics starts only after your consent; automatic page views, autocapture, and session recording are disabled. See our Privacy Policy and Cookie Policy.
Compliance status
We have not completed an independent SOC 2 or ISO 27001 audit, and we do not offer a HIPAA Business Associate Agreement. Do not use unbog for protected health information or workloads that require those assurances. If you have procurement or security questions, contact us and we will share what we can verify.
Report a security issue
Email admin@unbog.app or use the contact form and choose technical help. Include a clear description and a way to reach you. Avoid including passwords or other sensitive data in your report.