Security policy

Map For Us encrypts locations, messages, pictures and everything else people share on their own phones, and our server stores only what it cannot read. A flaw that lets us, the server or anyone else read something it should not is the most serious problem this app can have. This page says how to tell us.

How to report

Email support@aevoriscloud.com with the subject “Map For Us security”. Say what you found, how to reproduce it, and which app version or web page you looked at. We confirm we have it within three working days and keep you updated while we fix it.

Please do not post a security problem publicly before it is fixed, and only test with accounts and circles you created yourself.

Disclosure

We ask for 90 days from our acknowledgement before a finding is made public, and we will not ask for more. If a fix ships sooner, we will tell you and you may publish then. If a problem is being exploited, tell us and we will move faster.

There is no bounty programme. With your permission, we credit you in the fix.

In scope

• The Map For Us apps for iPhone, Android, Apple Watch and Wear OS, and the web app at www.mapforus.com.
• The service at www.mapforus.com and its API under /v1/.
• The encryption design: if the server can learn something about your location or messages that our privacy policy does not say it can, that is a finding even if the code does what it was written to do.

Out of scope

• What the privacy policy already says the server can see: which accounts are in which circle, which devices are yours, and when something was sent.
• Someone holding an unlocked phone that is signed in.
• Denial-of-service and volume tests, and scanner reports without a demonstrated impact.

The machine-readable contact is at /.well-known/security.txt.