Security at UrCosmo

UrCosmo is a private home for your whole life: tasks, journals, reminders, documents, contacts, and more. Security isn't a feature we bolt on — it's the foundation the product is built on. This page explains, without hand-waving, how we protect your account and your data. For how we collect and handle data, see Your Privacy Rights.

No passwords to steal

Sign-in runs entirely through Google or GitHub OAuth. UrCosmo never sees, receives, or stores a password for you — there is no password database to breach, and no credentials for an attacker to phish or reuse from another site's leak. Your session is managed server-side with a secure, http-only session identifier; the login state that lives in your browser is only an optimistic hint and is never the security boundary.

Your data is scoped to you

Every record in UrCosmo is tied to your user account, and the server resolves your identity from your authenticated session on every request — never from a value supplied by the browser or the app. Reads are filtered by your account; updates and deletes are matched against both the record id and your account id, so a foreign identifier can never match one of your rows.

There is no code path — not through the web app, not through the mobile app, not through the API — by which one user can read or modify another user's private data. Disabling a feature hides it from your interface, but access control does not depend on that: the server enforces ownership regardless of what the interface shows.

Shared and collaborative spaces

A few surfaces are intentionally multi-user — the collaborative Projects workspace, and public read-only share links you choose to create (for a Note space or a movie collection). Access to a Project is gated by an explicit membership record with a role (Owner, Admin, Member, Viewer), and every action re-checks that membership on the server before touching any data. Public share links expose only the specific content you opted to share, are marked noindex so search engines don't list them, and can be revoked by you at any time.

Encryption in transit

All traffic between your device and UrCosmo runs over HTTPS/TLS. We send HTTP Strict Transport Security (HSTS) headers so browsers refuse to connect over plain HTTP, and a strict Content-Security-Policy plus related hardening headers to defend against cross-site scripting, clickjacking, and content injection.

Encryption at rest

Your most sensitive free-text content is encrypted at the application layer with AES-256-GCM, using a fresh random initialization vector per record and keys held only on the server — before it is ever written to the database. That includes:

• Journal entries and reflections
• Note page bodies
• Contact notes (the “about them” field)
• Document notes
• Your private reviews and takeaways in the Movies & Series section
• Secrets stored in a Project Vault (username, password, note)

Because these fields are encrypted, they cannot be read by inspecting the database directly, and they are searched only server-side over a decrypted, in-memory result set — never in raw SQL. On top of application-layer encryption, our managed database and object-storage providers encrypt all data at rest at the disk level.

The Project Vault

A Project Vault is protected by a 4-digit PIN that is deliberately an access gate, not the encryption key (a 4-digit space is far too small to encrypt with). The PIN is stored only as a salted scrypt hash, verified with a constant-time comparison, and locks out after five wrong attempts for fifteen minutes. The secrets themselves are AES-256-GCM encrypted independently, so a forgotten PIN can be reset by the Project owner without any data loss, and a database leak alone cannot reveal a secret.

Private file storage

Uploaded files — documents, note attachments, project files, profile photos, and images — are stored in a private object-storage bucket that is not publicly listable. Uploads are proxied through our server (no direct public write access), file size and type are validated, and your plan's storage quota is enforced. Files are only ever reachable through short-lived, signed URLs generated for the signed-in owner (or, for content you explicitly shared, for that specific shared link), and each download route re-checks ownership before issuing the link.

Application hardening

• Input validation. Every server action and API endpoint validates its input against a strict schema before touching the database.
• CSRF-resistant API. The token-authenticated mobile API accepts only bearer tokens and rejects cookie authentication, which removes an entire class of cross-site request forgery.
• Rate limiting & secrets. Sensitive endpoints are rate-limited, and scheduled/background jobs (such as the daily digest email) are gated by signed secrets so they cannot be triggered by outsiders.
• Least-exposure by design. Encrypted fields are decrypted only on the server; ciphertext is never shipped to the browser. External lookups (link previews, book and movie metadata) run server-side with guards against server-side request forgery.

Payments

UrCosmo does not currently process payments. When paid plans launch, card and payment details will be handled entirely by a certified third-party payment processor — UrCosmo will never store your full card number or CVV on its own servers.

Infrastructure & providers

UrCosmo runs on reputable managed cloud infrastructure for hosting, database, object storage, email, and analytics. We choose providers with strong security postures and share with them only the data required to deliver the service. The full list of sub-processors is published in Your Privacy Rights.

Availability & backups

Our managed database provider maintains automated backups for disaster recovery. As with any online service, we can't guarantee uninterrupted availability, and you are always free to keep your own copy: the personal data export gives you a complete, structured download of everything UrCosmo holds about you.

Your role in staying secure

The most important account you protect is the Google or GitHub account you sign in with. Keep it secure with a strong, unique password and two-factor authentication, and never share your sign-in access. If you believe your account has been compromised, contact us immediately at [email protected].

Responsible disclosure

Found a vulnerability? We want to hear about it. Email [email protected] with a clear description and steps to reproduce, and we'll acknowledge your report and work to resolve valid issues as quickly as we can. Please act in good faith: give us reasonable time to fix an issue before any public disclosure, don't access or modify data that isn't yours, and don't run denial-of-service, spam, or social-engineering attacks. We won't pursue action against researchers who follow these principles.

Security is never “done.” We keep improving our practices as UrCosmo grows, and we'll update this page as those practices evolve. Questions about anything here? Reach us at [email protected].