Reporting a security problem
Outft is a location-sharing app used by kids and their families, so we take every report seriously. If you think you've found a security problem, please tell us privately first.
How to report
Email security@jointheoutft.com with what you found, how to reproduce it, and what someone could do with it. Please don't put the details in an app review, a support chat or a public post.
What we promise
- We aim to reply within 3 business days, and to keep you updated until it's fixed.
- We won't take legal action against you, or ask anyone else to, for research done in good faith under the rules below.
- With your OK, we'll thank you by name below once it's fixed.
The rules
- Test only with accounts you made yourself. Never look at, change or keep anyone else's data. If you reach someone else's data by mistake, stop, don't keep a copy, and tell us.
- Never contact, track or test on a real person, and never try to find where anyone is.
- Don't slow the service down for others: no denial of service, no high-volume scanning, no spam.
- No social engineering of our staff or users, and no physical attempts.
- Give us 90 days to fix it before you publish, or tell us if you need a different timeline.
In scope
- The Outft apps for iPhone and Android.
- api.jointheoutft.com, admin.jointheoutft.com and support.jointheoutft.com.
- www.jointheoutft.com and www.jointheoutfit.com.
Problems in the services we use (Apple, Google, DigitalOcean, Cloudflare, Supabase, Resend) belong with them. Tell us too if one of them affects Outft.
Thank you
People who have helped keep Outft safe will be listed here.
Who we are
Outft LLC, Colorado, USA.