Responsible disclosure

Found a security problem? Tell us first.

Snazzy holds things people do not tell everyone: who they are attracted to, what they believe, what they said to someone in confidence. If you have found a way to reach any of that, we want to hear from you before anyone else does.

Write to security@snazzy-app.com. Dutch or English, whichever you prefer. Include what you found, how to reproduce it, and what you think it exposes.

What we promise

• An answer within three working days, and a person to talk to until it is fixed.
• No legal action, and no report to the police, for research done in good faith within the rules below.
• Your name in our thanks once it is fixed, if you want it there, and nowhere if you do not.
• We are a small, non-commercial service and do not pay bounties. We will say thank you properly.

What we ask

• Use only accounts you created yourself. Never access, change, keep or share another member's data. If you reach someone else's data by accident, stop, tell us what you saw, and delete it.
• Do not message, match with or contact other members as part of your research.
• No denial of service, spam, social engineering of our staff or moderators, or physical attacks.
• Do not run automated scanners at a volume that troubles the service.
• Give us reasonable time to fix it — normally 90 days — before you publish, and agree the date with us.

Out of scope: reports without a demonstrated impact (missing headers on their own, version banners, self-XSS, clickjacking on pages without actions), and anything requiring a jailbroken device the victim controls.