Security

Transport security

Production user-data connections are required to use HTTPS/TLS. The protection available depends on the device, endpoint, and service configuration.

Storage and encryption boundaries

Storage protections vary by data type. Credentials and other account information do not all use the same storage protections. Backup expiry is distinct from deletion in active systems.

The Service does not provide end-to-end encryption that excludes every operator or administrator. Security and recovery capabilities require narrowly controlled service access.

Access control and account isolation

Access controls restrict personal information according to ownership, authorization, and purpose. Administrative and service access is limited to authorized responsibilities.

Authentication and recovery

Account access requires authentication. Jewekle does not ask users to send passwords or authentication links to support. Authentication does not provide consent for optional processing or product analytics.

Account protection

Account controls are intended to prevent one account's information from becoming accessible through another account. A failed cleanup is not treated as completed. Signing out and requesting account deletion are separate actions.

Diagnostics and product analytics

Crash diagnostics and optional product-usage analytics are separate. Diagnostic information is filtered to limit exposure of personal content. Product analytics require consent and use an account-linked pseudonymous identifier; they are not anonymous.

These controls are designed to keep receipt contents, merchant names, amounts, credentials, and authentication links out of telemetry. Report any observed failure of these protections.

Third-party and operational access

Providers and their purposes are described in the Privacy Policy. Authorized operational access may be needed for support, security, deletion, recovery, or legal obligations.

Report a security concern

Email security@jewekle.com with the subject “Security disclosure.” Include the affected surface, reproducible steps, impact, and a safe way to contact you. Do not include credentials, auth links, private receipt content, personal data belonging to someone else, or destructive proof.

Jewekle will acknowledge a report within 48 hours, provide a status update within 7 days, and fix critical issues within 30 days of triage. Jewekle may credit a responsible reporter with permission and does not offer a paid bounty.

Security safeguards and limitations

Technical and operational safeguards are used to protect the Service and the information it handles. These safeguards do not eliminate all risk. Jewekle has no SOC 2 or other security certification to present.

Questions

For a security concern, use security@jewekle.com. For ordinary app help, use Jewekle 載具 support.