Security & Privacy Overview

This page summarizes, in plain language, how Donnas-Bandwidth-Booster™ protects your account and data. For the full technical detail, see our Privacy Policy and Data Retention Policy. See also our Security Statement for a public-facing summary and our Incident Response & Security Notification Policy for what happens if something goes wrong.

Authentication

• Passwords are never stored in plain text — they are hashed with

bcrypt before storage, using a cost factor tuned for current hardware.

• Administrator accounts support an additional layer of protection

(time-based one-time-password multi-factor authentication) and are locked out after repeated failed attempts within a rolling window.

• Sessions are backed by short-lived access tokens and longer-lived,

revocable refresh tokens. Signing out immediately revokes your session.

Encryption

• All communication between the application and our servers uses TLS 1.3

in transit.

• Sensitive free-text content you explicitly submit (such as an opt-in

diagnostic report to support) is encrypted at rest (AES-256-GCM) before storage.

• Routine network-quality telemetry is numeric and transported over TLS,

scoped per-device by role-based access control.

Access Control

• Regular user accounts can only access their own devices and data.
• Administrative functions require an `admin` role and are further

gated by role-based access control on every request — an authenticated session alone is never sufficient to reach administrative endpoints.

• Every administrative action (role changes, feature-flag changes,

notification broadcasts, license changes, password changes) is recorded in an append-only audit log that application code cannot modify or delete.

Account Recovery

Administrator password resets require an out-of-band match against a pre-registered recovery contact before any credential is rotated, and always force a new password to be chosen on next login — a stolen or guessed session token alone is never enough to take over an account through the recovery path.

Vulnerability Reporting

If you believe you've found a security vulnerability, please report it responsibly using the Security Vulnerability Reporting contact in our Contact Information page rather than testing it against live user data. See also our Acceptable Use Policy for the authorized security-research exception, and our Incident Response & Security Notification Policy for our response process.

What We Do Not Do

• We do not sell your personal information.
• We do not collect precise location, browsing history, or other-app

usage data.

• We do not bundle diagnostic-report collection into routine telemetry —

it is always a separate, explicit, opt-in action.

Changes to This Overview

We will version this overview; if our security posture changes materially in a way that affects you, the updated version will be published here.