Sicherheit

1. What this policy covers

This website, mintakka.com; the services the apps and the website talk to, under mintakka.app — accounts, the route catalogue, the maps and live sharing; and the Mintakka™ apps for Android phones and Wear OS watches.

If you have found a way to read, change or delete something that is not yours, to act as somebody else, or to make one of these services do something it should not, we want to hear about it.

2. How to report

Write to security@mintakka.com, in English or Spanish. Tell us:

• what is affected — the address, or the app and its version;
• the steps that reproduce it, and what you saw;
• what somebody could do with it;
• how we can reach you if we have questions.

One problem per message. Leave out anybody else's personal information unless it is the finding itself, and then send only as much as shows it.

3. What happens next

We answer within five working days to say we have your report. We then tell you whether we could reproduce it, keep you up to date while we fix it, and write to you when the fix is live.

4. Testing in good faith

While you look for problems:

• use only accounts and data that are yours, or that the owner has let you use;
• if you reach somebody else’s data, stop there, report it, and do not keep, copy or pass on what you saw;
• do not slow the services down or take them offline — no load tests, no flooding, no automated scanning heavy enough to be felt by other people;
• do not publish test routes where other people will see them, and delete any you did publish;
• do not try to trick people — no phishing, no social engineering — and do not touch anything physical.

5. We will not come after you

If you follow this policy, we consider your research authorised. We will not take legal action against you over it and we will not report it to the police. If somebody else does, we will say that you acted under this policy.

6. What we do not need to hear about

Reports with nothing an attacker could do with them, such as:

• a missing header or setting, without a way to use its absence;
• mail settings such as SPF, DKIM or DMARC, without a message that actually got through pretending to be us;
• framing a page that has no action on it;
• problems that need an old browser, or a phone that is already compromised or rooted;
• denial of service by volume.

A flaw in a service we use — Cloudflare, Google, MapTiler, RevenueCat — belongs to that service, and it is to them that it should be reported. If it affects Mintakka as well, tell us too.

7. Publishing what you found

Please keep it between us until it is fixed, or until 90 days after your report, whichever comes first. If a fix needs longer, we will tell you why and agree a date with you.

8. No bounty

There is no paid reward for reports. What we can offer is a fast answer and a fix.