Security

How we protect your information

• Every connection to Deadline Wallet is encrypted (HTTPS).
• Passwords are stored only as one-way hashes.
• Receipts and proof files are kept in private storage that only your account and the people who run Deadline Wallet can reach.
• Older files uploaded before November 2026 may still be stored with Uploadcare, the file storage our earlier app used. Anyone who has the link to one of those files can open it; we don’t share those links. Email support@deadlinewallet.com and we will have them removed.
• Resetting your password signs you out everywhere.
• Error reports remove email addresses and never include your records or receipts.
• Only the people who run Deadline Wallet can reach our systems, and those accounts use two-step sign-in.
• We don't sell your information or use advertising trackers.

If you think your account has been compromised, reset your password and email support@deadlinewallet.com right away.

Report a security problem

We welcome reports from security researchers and users. Email security@deadlinewallet.com with:

• what you found and where (web page, API address, or app and version)
• the steps to reproduce it
• what an attacker could do with it

Please don't include other people's personal information in your report.

What we promise

• We'll confirm we received your report within 3 business days.
• We'll tell you what we plan to do within 10 business days, and keep you updated until it's fixed.
• We'll credit you publicly once it's fixed, if you'd like. We don't offer payment for reports.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we won't take legal action against you, and we won't ask anyone else to. If someone else takes action against you for research done under this policy, we will make it known that you acted with our permission.

Rules for testing

• Test only with accounts you created yourself.
• Don't view, change, copy or delete anyone else's data. If you come across someone else's data, stop, don't keep it, and tell us.
• Don't run denial-of-service attacks, send spam, try social engineering or phishing, or test physical security.
• Don't run automated scans that slow the service down for others.
• Give us 90 days to fix a problem before you talk about it publicly.

In scope

• deadlinewallet.com, including its API
• The current Deadline Wallet apps for iPhone, iPad and Android

Out of scope

• Services run by other companies, such as Apple, Google, Stripe, Vercel or Cloudflare (report to them directly)
• Automated scanner output with no working proof of a problem
• Missing "best practice" settings that don't lead to a real attack
• Problems that need a stolen, unlocked or rooted device

Our security contact details are also published at deadlinewallet.com/.well-known/security.txt.