Security

These are the practices we run today to protect your account, payments and photos. We update this page when they change.

Accounts and sign-in

• You sign in with a one-time code sent to your email, or with Google or Apple.
• Sign-in and code requests are rate limited to slow down guessing and abuse.
• Sign-up uses Cloudflare Turnstile to filter automated traffic.

Payments

Web payments are handled by Creem, our merchant of record, and App Store purchases by Apple. Card details go to them directly; Phosphene never receives or stores full card numbers.

Your photos and results

• Reference photos are private to your account. Deleting a photo, or your account, removes the stored files.
• A photo is sent only to the AI provider behind the model you choose, for that request. We turn off request storage at fal.ai and require zero-data-retention routing on OpenRouter.
• Images you publish to the Community gallery or share by link are public until you remove them.

Infrastructure

• Every connection uses HTTPS, with HTTP Strict Transport Security so browsers refuse plain HTTP.
• A Content Security Policy limits which scripts and services pages can load, and pages refuse to be framed by other sites.
• Traffic passes through the Cloudflare firewall before it reaches our servers.
• The database is backed up nightly to separate object storage and kept for 30 days.
• Errors are monitored with Sentry, and service health is public on our status page.
• Internal activity and request logs are deleted after 90 days, and immediately when an account is deleted.

Report a security issue

Email [email protected] with the subject "Security report", the steps to reproduce and the impact you observed. The same contact is published in our security.txt. Please give us reasonable time to fix an issue before sharing it publicly, and avoid accessing other people's data while testing. We do not run a paid bug bounty.

See also the subprocessor list and the status page.