Security

Your passcode is protected

Your passcode is encrypted before it's ever written to the database. The encrypted version is all that exists while your commitment is active. When your commitment ends and you request a reveal, the server decrypts it for that one response, sent only to your authenticated browser.

• Encrypted at rest. We use established authenticated encryption (not custom cryptography) to protect stored passcodes.
• Never logged. Plaintext passcodes, encryption keys, and secrets are never written to application logs, analytics, or error messages.
• No staff override. There is no internal tool, admin panel, or support process that lets anyone at ScreenVow view or reveal your passcode. The only way to see it is your own authenticated reveal request, after your commitment period and its cooldown have both passed.

The reveal process has a built-in pause

Even after your commitment period ends, revealing your passcode isn't instant. Requesting a reveal starts a one-hour waiting period before it's actually shown — a deliberate design choice, not a technical limitation, to give you a little time to reconsider before you see it. If you decide you'd rather not have it back at all, you can permanently delete it instead and reconfigure Screen Time yourself.

Your account controls access

Every sensitive request is authenticated and checked against the signed-in user on the server, so an account can only ever access its own passcode data.

• Server-side data access. Your browser never talks to the database directly — every operation goes through an authenticated server endpoint, with database-level access controls (row-level security) as a second layer restricting each account to its own records.
• Protected connections and sessions. The service uses HTTPS everywhere and secure, server-managed sessions rather than storing anything sensitive client-side.
• Your passcode never touches your browser unnecessarily. It's never placed in a URL, and it's only ever sent to you at the one moment you've completed a valid, authenticated reveal request.

We collect only what the service needs

ScreenVow stores your email address, account creation date, subscription status, and encrypted passcode data — that's what the service needs to work. We don't sell personal data or build an advertising profile around you. You can delete your passcode once your commitment ends, and you can request deletion of your entire account at any time. See our Privacy Policy for the full picture of what we collect and why.

Built on managed infrastructure

ScreenVow runs on managed, serverless hosting (Vercel) with a managed database (Supabase), rather than a single server we maintain ourselves — this is standard, well-tested infrastructure built for reliability, not something we've rolled on our own.

Questions or a security concern?

If you have a security question, or think you've found a vulnerability, email support@screenvow.com. Please report it to us privately first so it can be investigated and fixed before anything is made public.