security
Quietly careful.
Your shelf is a small window into your home. We treat it that way.
Accounts
- Passwords are hashed with bcrypt and never stored or logged in plain text.
- Sessions are signed, HTTP-only cookies. Sign-in with Google uses OAuth; we never see your Google password.
- Password resets use single-use links that expire after one hour.
Photos
- Photos are resized in your browser before upload, which strips most metadata, including location.
- Demo photos are processed in memory and never stored.
- In your account we keep a small thumbnail per plant and per reading. They are served only to you and anyone you share a Greenhouse shelf with.
- Photos are sent to our AI providers only to produce your reading. We do not let providers train on them where a setting exists, and we never sell them.
Infrastructure
- Everything is served over HTTPS with strict security headers.
- Payments run through Stripe; card numbers never touch our servers.
- Rate limits protect the public demo and every sign-in and form route.
Report a vulnerability
Email security@getfernfriend.com. We acknowledge reports within two business days and will not pursue good-faith research.