Your reflections are sacred. Here's how we protect them, what we promise, and what we are honestly still working toward.
All traffic between your device and our servers is protected with TLS 1.2+. Data at rest in our managed Postgres database is encrypted using AES-256. Sensitive client-side session data is stored in encrypted secure storage.
Every user-owned table is protected by Row-Level Security (RLS) policies enforced at the database layer — not just in application code. You can only ever read or modify your own journal entries, chats, and preferences.
Administrative actions require an explicit role in a dedicated user_roles table and are additionally checked server-side in edge functions.
Sensitive actions (admin operations, data exports, account deletions, subscription changes) are recorded in an append-only audit log. IP addresses are masked after 7 days and fully anonymized after 30 days.
We run on Supabase (Postgres, Auth, Edge Functions), Stripe (payments), and Resend (transactional email). Each provider operates SOC 2 Type II certified infrastructure.
You can export all of your data or permanently delete your account at any time from Settings. Deletion removes journal entries, chats, preferences, and authentication records within 30 days.
WithVidVan is not currently HIPAA-certified and has not completed an independent SOC 2 audit. We have implemented many of the technical controls these frameworks require, but we will not advertise certification we have not earned. If you need a HIPAA Business Associate Agreement, please contact us before using the service for protected health information.
WithVidVan is a wellness companion. It is not a substitute for licensed medical or mental-health care. If you are in crisis, please contact local emergency services.
Found a security issue? Please email security@withvidvan.com. We will acknowledge within 72 hours and work with you in good faith on disclosure.