Security

Isolation between accounts

Every table that holds your data has Postgres row-level security turned on. The database itself only returns rows whose owner is the signed-in user; the app cannot ask for anyone else's, even by mistake. Reference data (the step template library) is read-only for signed-in users and holds no personal data.

Encryption

All traffic is HTTPS (TLS). Data at rest is encrypted by our providers, Supabase and Vercel, using their standard provider-level encryption. [FOUNDER TO REVIEW] Link to Supabase and Vercel security pages and confirm region.

Keys and access

• The browser only ever holds a publishable key that is constrained by row-level security.
• The privileged key exists only on the server, in a handful of server actions (account creation in the private beta, account deletion, analytics reads for the admin view). It is never in a client bundle.
• Passwords are hashed by Supabase Auth; we never see or store them in plain text.

Abuse protection

Account creation, sign-in, exports and analytics ingestion are rate-limited per address and per account. When enabled, account creation is protected by Cloudflare Turnstile, a privacy-respecting bot check that does not track you across sites.

Analytics

We measure how Nextep is used with our own events table. Events carry names, ids, counts and settings — never step or journey text, and never your email. There are no third-party analytics or ad SDKs.

AI features

AI help is optional and off by default. When you use it, only the text needed for that request is sent, after removing emails, phone numbers, links and handles; no account identifier travels with it; and a Privacy Receipt in the app shows you exactly what was sent, where it was processed, and for how long it is kept. [FOUNDER TO REVIEW] Confirm the AI provider's data-retention setting and name the provider here when Phase 3 ships.

Google Calendar

Sync uses a single Google service account that Nextep controls; its key lives only in the server environment and is never sent to the browser. You grant access by sharing a calendar with that account, so there are no user OAuth tokens to store or leak. The server requests only free/busy and event scopes, reads free/busy plus the events it tagged itself, and refuses to touch untagged events. Revoking the share in Google Calendar cuts access instantly, without waiting for us.

Your controls

Export everything or delete your account from the Me tab, immediately and without asking us. Deletion is permanent.

Reporting a problem

Found something? Email alisher@usenextep.com. We read every report and we will tell you what we did about it.