Security

PileBreak holds photographs of the inside of your home and the things in it. We treat that as sensitive. This page describes the controls we use, in plain terms, so you can judge them for yourself.

We would rather describe accurately what we do than claim certifications we do not hold. Nothing on this page is a warranty.

In transit: all traffic between the app, the web portal and our servers uses TLS. We do not provide an unencrypted path.

At rest: photographs and database contents are encrypted at rest by our infrastructure provider using industry-standard disk encryption.

Credentials: passwords are stored only as salted hashes. We cannot read your password.

Each account can only reach its own records. This is enforced at the database level by row-level access rules rather than only in application code, so a bug in the app does not by itself expose another user's piles, items or photographs.

Signing out clears the local cache of your data from the device, so a shared or resold phone does not retain your piles.

Accounts are protected by password authentication, Sign in with Apple or Sign in with Google, which means we never handle your Apple or Google password.

Administrative access to production systems is limited to those who need it, and is protected by key-based authentication rather than passwords.

Photographs are stored in private object storage. They are not publicly readable: access is granted per account, not by guessable public link.

To identify items, a photograph is transmitted to our image-recognition provider for processing and the result is returned to us. That transfer is encrypted. We do not publish your photographs, and we do not use them to train AI models.

Deleting a pile removes it from your active lists. Erasing it permanently, or deleting your account, removes the associated photographs and records from our active systems. See the Privacy Policy for retention details and the limited cases where we must keep something.

Our provider takes regular encrypted backups so that data can be recovered after an infrastructure failure. Backups are short-lived and are not a way for us to keep your deleted data indefinitely.

If you believe you have found a security problem in PileBreak, please tell us at pilebreak+support@gmail.com. Include what you did, what happened, and what you expected.

Please do not access other people's data, disrupt the Service, or publish details before we have had a reasonable chance to fix the issue. We will acknowledge your report, keep you updated, and credit you if you would like.

Use a strong, unique password. Keep your device passcode on, since PileBreak data is cached on the device. Be thoughtful about what you photograph: do not capture documents, screens, keys, or other people without their consent.