1. Our Approach to Security
XPadite holds the plans, notes and time records that help you organise your life, so we treat protecting them as part of the product. Rather than build security infrastructure from scratch, we rely on established services for authentication, data storage and hosting, and we configure them so that each person can only reach their own information.
Security is an ongoing effort, not a finished state. No online service can be made completely secure, and we do not guarantee that a breach, loss or misuse can never happen. XPadite is operated by an individual in British Columbia, Canada; we do not claim any third-party security certification or independent security audit.
2. Account Authentication
XPadite uses Supabase Authentication and its account-management functionality to create and manage accounts. In practice:
- You sign up with your name, email address and a password, and confirm your email through a link we send you.
- Your password is handled by the authentication service; XPadite does not keep it in readable form.
- Signed-in sessions are managed by the authentication service, and the signed-in areas of the App require a valid session.
- You can change your account email and password from your profile in the App.
- Sign-in with Google, Apple or Microsoft is not currently available.
3. Data Protection
Your account content, such as your calendar entries, activities, time sessions, preferences and gallery items, is stored in a Supabase-hosted database and file storage. Files such as profile photos are delivered through short-lived, signed links rather than public addresses.
Providers such as Supabase and Vercel describe encryption of stored data and protective measures at their infrastructure level. We do not offer end-to-end encryption, which means content you store is readable by the services that host it so that features such as sync, search and analytics can work.
4. Access Controls
- Row-level security. The database tables that hold user content have row-level security rules turned on so that a signed-in user can read and change only their own records.
- Server-only privileged access. The few operations that need elevated permissions, such as deleting an account or processing scheduled reminders, run on the server. Their privileged credentials are never sent to your browser, and an account deletion is always tied to the person who is signed in, not to a value supplied by the request.
- Limited operator access. XPadite is run by one individual, and access to the hosting and database accounts is limited to the operator.
5. Secure Connections
The Website and App are served over HTTPS, and our connections to our hosting and database providers are encrypted in transit, which protects information as it travels between your device and the Service. This protects data in transit; it does not protect against threats on your own device, such as malware or a stolen, unlocked phone.
6. Payment Security
Online checkout is not yet available. When it is introduced, Stripe will process payments: you will enter card details on Stripe’s own secure payment pages, and XPadite will not store your full card number or security code. We will keep only the subscription and transaction records needed to run your plan (see the Privacy Policy). Stripe maintains its own security programme, described in its documentation. Until checkout is live, no payments are processed through the Service.
7. Account Security Responsibilities
Account security is shared. You can help protect yours by:
- using a long, unique password that you do not use anywhere else (the sign-up form only requires 6 characters, but longer is much safer);
- keeping your email account secure, since it can be used to confirm and recover access;
- never sharing your password, and signing out on shared or public devices;
- keeping your browser, operating system and devices up to date; and
- being cautious of phishing: XPadite will never ask you for your password by email or message.
If you notice sign-in activity, emails or changes you do not recognise, change your password straight away and contact us using the details below.
8. Reporting Security Concerns
If you believe you have found a vulnerability, or you suspect your account has been compromised, please email support@xpadite.com. Helpful details include what you found, the steps to reproduce it, the affected page or feature, and the email address of the account involved (never include your password).
We will acknowledge reports promptly and look into them. Please act in good faith: do not access, change or delete other people’s data, do not disrupt the Service, and give us a reasonable opportunity to fix an issue before you disclose it publicly.
9. Security Updates
We keep the Service and its components updated and review how it is configured as it evolves. When we introduce significant new capabilities that affect security, such as online payments or AI-powered features, we will update this page and our Privacy Policy first. If a security incident affects your personal information in a way that creates a real risk of significant harm, we will notify you and any regulator as the law requires. The “Last Updated” date above shows when this page last changed.