Security

• In transit. Every connection to Path of Prose uses HTTPS. A plain, unencrypted request for a page is sent to the HTTPS address, and our server answers only over HTTPS.
• On our servers. Your books and account are stored on Amazon Web Services in the United States and encrypted at rest.
• Sign-in. Accounts are by invitation, and sign-in runs on Amazon Web Services' sign-in service under our control. Each request to our server must carry your sign-in, and you can only reach your own books.
• One server, nothing else. The app's pages load nothing from any other company: no scripts, fonts, trackers or analytics. Each page carries a strict content security policy that tells your browser to refuse anything else.
• Saving never overwrites. Every save is checked against the version it started from, so a change made on another device is shown to you, never silently replaced.
• Deleting a book moves it to the archive first, and a deleted account waits 21 days before anything is purged, as our privacy policy explains.
• Who can see it. We look at your records only to run the service, fix a fault or answer a request you made. The companies that help us run the service are listed on our subprocessors page.

• Set a screen lock on your phone, and turn on device encryption on a computer. The copy of your books on your device is protected by your device, not by the app.
• Keep your email account safe, because that is how you sign in.
• Download everything now and then from Settings, Your data, so you always have your own copy.
• Sign out on a shared computer. The app warns you first if a change hasn't reached our server yet.

If you think you've found a security problem in Path of Prose, email arnikllc+pathofprose@gmail.com with what you found and how to reproduce it.

• Please don't read, change or delete anyone else's data, run load or denial-of-service tests, or use social engineering. Test only with your own account.
• Give us a reasonable time to fix it before you tell anyone else.
• We'll reply, keep you posted while we fix it, and thank you publicly if you'd like.

Our contact details are also published in machine-readable form at /.well-known/security.txt, as RFC 9116 describes.

If a breach affects your personal information, we will tell you, and the authorities where the law requires it, without undue delay.

ARNIK LLC, 5477 N Saddle Stone Dr, Eagle Mountain, UT 84005, United States. Email arnikllc+pathofprose@gmail.com.