Security

This page describes what we actually do to protect your account and data. No app is perfectly secure; if you find a problem, please tell us.

Sign-in

• Felia has no passwords. You sign in with a one-time code sent to your email address.
• Your session is stored in your iPhone's keychain.

Connections and storage

• The app and this website only communicate over encrypted connections (HTTPS/TLS).
• Data is stored with our provider Supabase in Frankfurt am Main, Germany.

Who can see what

• Who may see which classes, posts, profiles, groups and messages is checked by the database itself on every request, not just in the app.
• Only members can read and write in a group chat. Replies, mentions and photos stay within their group.
• Only the person who created a group can make it public.
• Blocked people don't see each other's content or receive push notifications from each other.
• Photos are stored at random, unguessable addresses. Anyone who knows an address can, however, open the photo without signing in.
• Chats are encrypted in transit but not end-to-end encrypted.

Abuse prevention

• Limits on messages, comments, posts, friend requests, reports and code entries prevent spam and guessing invite codes.
• Push notifications are sent once per action and limited per person.
• Links on classes must point to Urban Sports Club.
• People, classes, posts, communities and chat messages can be reported; people can be blocked.

This website

getfelia.com has no forms, sets no cookies and loads nothing from third parties. Strict security headers (including a Content Security Policy and HSTS) are set.

Found a vulnerability?

Please email hallo@getfelia.com with the subject "Security" and a short description of how to reproduce it. Please don't access other people's data, change or delete anything, and don't publish the issue until we've been able to fix it. We'll get back to you as soon as possible.