Security

What we commit to

BrewTrax stores personal brew logs. We treat that as private by default. This page describes the practices we follow in the current product — not an audit badge, SOC report, or guarantee that no incident will ever occur.

Transport and storage

Traffic to the website and API is HTTPS only; there is no cleartext endpoint. Passwords are stored as salted scrypt hashes. Refresh tokens are held hashed, expire, and can be revoked. Photos and notes live in access-controlled storage tied to your account, and every query that reads them is scoped to the signed-in user.

We do not log the contents of tasting notes, and there is no analytics or crash-reporting SDK in the app to send them anywhere. The smallest surface we can run is the one we want.

Accounts

• Sign in with Google, with Apple, or with an email and password. Passwords are stored as salted scrypt hashes, never in a form we can read back.
• We will never ask for your password by email or in Commons.
• You can sign out of sessions from Profile and delete the account outright.

Sharing

Only recipes and posts you explicitly publish to Commons are visible to other people. Private ledger entries are not searchable and are not used for advertising.

If something goes wrong

Report suspected vulnerabilities or account takeover to [email protected]. Please include steps to reproduce and avoid testing against other users' data. We aim to acknowledge reports and to notify affected accounts if a breach involving personal data is confirmed.

Your part

Keep the OS and the BrewTrax app updated. Do not screenshot private logs into public chats. Review Commons visibility before you publish. For data rights, see Privacy. For help, see Support.