Security

Encryption

• Every page and connection uses HTTPS, and browsers are told to use it every time.
• Dates of birth, addresses, phone numbers, important dates, trip details and photos are encrypted (AES-256) before they are saved. The key is kept separately from the database.
• Passwords are never stored. We keep only a salted one-way hash.

Signing in

• When you sign in with a password, we email a one-time code that is valid for 10 minutes.
• After 5 failed attempts, sign-in is locked for 15 minutes.
• You can sign in with Google or Facebook instead, and we never see those passwords.
• The sign-up and forgot-password forms use a privacy-friendly bot check (Cloudflare Turnstile).
• Sessions use secure, HTTP-only cookies and end after two hours. We use no tracking cookies.

Who can see what

• Only you see your profiles. Someone else sees one only if you invite them and choose what to share, and you can stop at any time.
• Photos are never public. An AI assistant you connect gets a link that expires after an hour.
• Assistants and stores you connect see only what you approve, and cannot change your profiles. Stores get a size suggestion, not your profile.
• We never sell your personal data.

How the app is protected

• Forms are protected against cross-site request forgery, and database queries are parameterized.
• Browsers are told to block framing, content sniffing and unwanted scripts (security headers and a content security policy).
• Names and emails are kept out of our logs. Failed sign-in records are deleted automatically after 90 days.

Who else handles data

Only where it is needed, and described in the Privacy Policy:

• Hostinger hosts the app and database.
• Cloudflare delivers the site, runs the bot check and counts visits without cookies.
• Anthropic (Claude) receives searches and the details needed to suggest sizes and gifts, and photos only when you choose color or style analysis.
• Shopify receives product searches (no account or contact details) and shows the "Fit me with PrefNest" button in stores that install it.
• Google and Facebook, if you choose to sign in with them.

Deleting your data

Delete a person or your whole account whenever you like. When you delete your account, we remove your personal data within 30 days. How to delete your data.

What we have not done yet

PrefNest has not yet had an independent security audit or certification. We plan an outside penetration test as we grow, and we will say so here when it is done.

Report a security problem

If you find a weakness, please tell us before sharing it publicly: support@ganootech.com. Tell us what you found and how to reproduce it. We will reply, fix what is real, and thank you.

Please test only your own account, do not read or change other people's data, and do not disrupt the service. Good-faith reports made this way are welcome. Our security.txt lists the same contact.