1. Security design
- Local-first storage: core data is held in the app’s private iOS storage rather than a developer-operated account server.
- Optional private CloudKit sync: when enabled, supported records are stored in the private database associated with your iCloud account. Apple provides the platform’s authentication, transport, and storage protections.
- Apple StoreKit payments: Apple processes payment credentials; Rhythmark uses transaction and entitlement status to unlock Pro.
- Limited widget sharing: only the snapshot needed to render the widget is shared through the app’s Apple App Group.
- No advertising or analytics SDKs: the current release contains no third-party advertising, behavioral analytics, or cross-app tracking SDK.
- Production separation: release builds use the production CloudKit environment and the production app identity configured through Apple.
2. What you can do
- Use a device passcode or biometric lock and enable two-factor authentication for your Apple Account.
- Install Rhythmark only from the App Store or TestFlight invitations you trust.
- Keep iOS and Rhythmark current.
- Review export contents before sharing, especially when reflections are included.
- Do not share passwords, verification codes, or payment-card information with support.
3. Report a vulnerability
Email wchao.jim@gmail.com with the subject [Security] Rhythmark. Include:
- the affected app version/build and iOS version;
- a clear description of the issue and its potential impact;
- minimal, reproducible steps or a proof of concept;
- whether any real user data may have been accessed; and
- a safe way to contact you.
Remove secrets and personal data from screenshots or logs. If sensitive details are needed, first ask how to share them safely.
4. Responsible testing rules
Please test only with accounts, devices, and data you own or have explicit permission to use. Do not:
- access, alter, retain, or disclose another person’s data;
- use social engineering, phishing, physical attacks, or credential theft;
- perform denial-of-service, destructive, automated high-volume, or availability-impacting tests;
- target Apple, GitHub, email providers, or other third-party infrastructure; or
- publicly disclose an unresolved issue before there has been a reasonable opportunity to investigate and address it.
This page does not authorize activity that violates law or third-party terms.
5. Response and scope
The goal is to acknowledge a complete report within seven calendar days and then prioritize it by severity, reproducibility, and user impact. This is a target, not a guaranteed service level. You may be asked for more information.
This disclosure channel covers the current Rhythmark App Store/TestFlight builds and this official static site. It does not include Apple, iCloud, TestFlight, GitHub Pages, or other third-party services. There is currently no paid bug-bounty program.