Security
Last updated 27 August 2026
A LiveOps calendar is an unreleased roadmap. Here is exactly how it is protected, and what is not protected yet.
Who runs this
One person: Aleksandar Šoškić, in Belgrade. Not a company and not a team — which means exactly one human being can reach the database, and you know his name.
In transit
Everything travels over TLS, always. The session cookie is marked secure unconditionally, so it cannot be sent over a plain connection even by mistake.
At rest
AES-256 disk encryption at our database provider. That defeats a stolen disk. It does not defeat someone with database access — see below.
Who can see your boards
People you invited, limited to the role you gave them, and anyone holding a share link you created, until you revoke it or archive the board.
Those limits are enforced inside the database, not just in the interface, so they hold even if a bug in the app tried to ignore them. 117 automated checks prove it on every change.
And us
Board content is not encrypted at the application level, so whoever operates the database can read it. That is one person, and only ever to fix a fault you have reported. End-to-end encryption — where the server holds text it cannot read — is planned, and is not in place today.
Signing in
No passwords exist anywhere in this product, so there is no password database to leak. Your email inbox is the key to your account; protect it accordingly.
Analytics never sees your work
Product analytics records which steps you reach, never what you typed. Board names, notes and share links are stripped before anything leaves the browser, and you appear as an internal id rather than an email address. That was verified by pointing the analytics client at a local server and reading every request it made, rather than by trusting it to behave.
Where your data lives
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Supabase | Stores your account and every board | Your email address and all board content | European Union (Frankfurt) |
| Vercel | Runs the application and serves the pages | Requests and IP addresses | United StatesEU–US Data Privacy Framework |
| Resend | Sends your sign-in links | Your email address | United StatesEU–US Data Privacy Framework |
| PostHog | Product analytics, only if you agree to it | Which steps you reach. Never board content, never your email | European Union |
| Cloudflare | Checks that a sign-in is a person, not a script | Your IP address, briefly | Global network, closest location to youStandard Contractual Clauses |
Your account and your boards are stored in the European Union. This page changes at least 30 days before anybody joins that list.
The service is operated from Serbia, so the one person named above reads the database from outside the EU when fixing a fault you have reported.
Found a problem?
Write to mail@soskic.me and say what you found. One person reads it, usually within two working days. There is no bug bounty, and nobody who reports something in good faith will be threatened for it.
What is not done yet
Being straight about this is worth more to you than a longer list of what is:
- No end-to-end encryption. The operator can read board content.
- No backups. Deleting something is immediate and permanent.
- No SOC 2 or ISO certification, and no audit log of who viewed what.
What we hold about you, and your rights over it, are on the privacy page.