Security

How to report

Write to support@nightwool.com with "Security" in the subject. English or Slovak is fine. This is the same inbox as Settings → Send Feedback in the app, and it's read by the person who builds Nightwool. If you can, include:

What's affected: iPhone or Android, the app version (shown at the bottom of Settings) and your system version, or the page address on nightwool.com.
Steps to reproduce it, and what an attacker could do with it.
How to reach you, and whether you'd like to be credited by name.

Please don't send other people's personal data. A short description is enough; we'll ask if we need more. The same contact is listed in our security.txt.

What's covered

The Nightwool app for iPhone and Android, in the current version from the App Store or Google Play.
nightwool.com, including the sign-up form, and the old addresses noctune.app and nightwool.app that redirect here.

Payments, subscriptions and store accounts are handled by Apple and Google, and purchase checks by RevenueCat. Problems in their systems belong to them: Apple Security Research, Google Bug Hunters. If you aren't sure whose problem it is, write to us and we'll pass it on.

Please don't report: reports from automated scanners without a working example, missing best-practice headers with no real impact, problems that need a rooted or jailbroken phone or someone else's unlocked phone, social engineering, or denial of service.

What happens next

We confirm that we got your report within 5 working days.
We check it, tell you whether we can reproduce it and keep you posted while we work on it.
Nightwool is built by one developer, so we can't promise a fixed date for a fix. Serious problems come first.
Security fixes are free and reach you as an app update through the App Store or Google Play.

Coordinated disclosure

Please give us a chance to fix the problem before you publish it. We ask you to wait until a fix is available, or 90 days after your report, whichever comes first. If a fix needs longer, or the problem is already being exploited, we'll agree on a different date with you. When the fix is out, we describe it on this page and credit you if you want.

There's no bug bounty: we can't pay rewards, but we're genuinely grateful for every report.

Safe harbor

If you research and report in good faith and follow this policy, we won't take legal action against you or ask anyone else to. In return, please:

test only on your own devices, and don't access, change or keep other people's data;
stop and tell us as soon as you come across personal data, and then delete it;
don't disrupt the website or flood the sign-up form;
keep the details private until the problem is fixed, as described above.

We can only speak for our own app and website, not for Apple, Google, RevenueCat or other services.

Fixed vulnerabilities

After each security fix we list here what was affected, how serious it was, which version fixes it and what you need to do. No security fixes have been published yet.

Keeping the app up to date

All updates, including security fixes, come only through the App Store and Google Play. The easiest way to stay safe is to keep automatic app updates on:

iPhone: Settings → App Store (on iOS 18 and later: Settings → Apps → App Store) → App Updates.
Android: Google Play → profile icon → Settings → Network preferences → Auto-update apps.

Our support period for security fixes runs until December 2032 (see the terms). Fixes go into the latest version, so please keep the app updated.

Nightwool is made by Michal Piják DEV, Na Hrebienku 1498/35, 811 02 Bratislava, Slovakia. What data the app and this website handle is described in the privacy policy.