Security

Gimmi is built on established, widely-used infrastructure rather than custom-built security tooling - Supabase for authentication and data, Vercel for hosting. This page describes what that means in practice, plainly, without overstating it.

All traffic between your browser and Gimmi is encrypted over HTTPS. Data at rest is stored in Supabase's managed Postgres database, which encrypts data at rest as part of its standard infrastructure.

Sign-in is handled entirely by Supabase Auth - Gimmi never stores or sees your password directly. Access to society data is enforced with database-level row-level security policies, so a request for another society's data is rejected by the database itself, not just hidden in the interface.

Database backups are managed as part of Supabase's infrastructure.

Gimmi runs on Vercel's hosting infrastructure. We don't currently publish a formal uptime guarantee - see the Status page for current and historical availability once live monitoring is connected.

If you believe you've found a security issue in Gimmi, we'd genuinely like to hear about it before anyone else does. We don't currently run a paid bug bounty programme, but we will acknowledge reports promptly and keep you updated as we investigate and fix confirmed issues.

Email a description of the issue, steps to reproduce it, and any relevant screenshots to:

hello@gimmi.golf

Please avoid accessing or modifying data that isn't yours while investigating an issue - report what you find instead, and we'll take it from there.