Security claims should be specific and verifiable.

Scope

This page covers the FitBound mobile app and its backend services. It does not cover third-party services we link to but don't operate.

Accounts and access

FitBound accounts are authenticated through our backend provider (Supabase Auth). Application data is protected with row-level security policies scoped to each signed-in user, so one account cannot read another account's workout, nutrition, or progression data through the normal app API.

Server authority

Reward-affecting actions — like XP, currency, and inventory changes — are processed server-side rather than trusted from the client app. This is part of the current product design, not a claim that the system is immune to abuse; hardening this further is ongoing work.

What we don't claim

We don't use terms like “bank-grade,” “military-grade,” or claim SOC 2, HIPAA, penetration-tested, or bug-bounty status. If we don't have documented evidence for a security claim, we don't make it on this site.

Report a vulnerability

If you believe you've found a security issue, email security@fitboundonline.com with as much detail as you can safely include: affected endpoint or screen, steps to reproduce, and potential impact. Please don't include real account credentials, other people's data, or unnecessary personal health information in your report.

We don't currently run a paid bug-bounty program. We review reports as a small team and will acknowledge receipt, but we can't promise a specific response time.

Last reviewed: August 3, 2026.

See also Privacy Policy and Support.