Security

• Every connection to when.day and our API uses HTTPS.
• Your session lives in an encrypted cookie that scripts on the page can't read.
• Requests for your calendar data check that you're signed in and can access that calendar. Public pages show only what their owner made public.
• Changing your email or turning on two-step verification needs a code we email you. Removing an authenticator needs a code from it.
• Settings lists your signed-in devices and can sign out all the others.
• Sign-in, bookings, public pages, the API, and the assistant are rate limited.
• Card details go to Polar, which handles payments, and never reach us.

Your data is stored with Convex, WorkOS, and Cloudflare; the Privacy Policy lists every provider. When has no security certifications or outside audits yet.

• The when.day web app and API send standard security headers, but neither has a full Content Security Policy yet. The web app's policy only stops other sites from framing it.
• Signing out keeps an offline copy of your calendars in the browser. On a shared computer, clear when.day's site data after signing out.

Email hey@when.day with "Security" in the subject, the steps to reproduce the problem, and what an attacker could do with it. We aim to reply within three business days, and for valid reports we'll keep you updated on what we're doing and when it's fixed.

If you test in good faith, we won't take legal action against you or ask anyone else to. Good faith means you:

• use only accounts you own or have permission to use;
• don't access, change, or keep other people's data, and stop and tell us if you come across any;
• don't degrade When for other people;
• give us reasonable time to fix the problem before you share it.

Denial of service, spam, social engineering, physical attacks, and scanner output without a working example are out of scope. Report problems in WorkOS, Convex, Cloudflare, or Polar to them, though we'd still like to hear about anything that affects When.

We don't run a bug bounty yet. If you'd like credit, we'll thank you by name once the fix ships.