Security

SameWhen is designed for informal group scheduling over a shared link. This page summarizes the security posture at a high level. It is a draft placeholder, not a formal security whitepaper.

Unauthenticated by design

There are no accounts. Identity on an event is a display name plus a session cookie on your device. Anyone with the event link can open the event. Treat links as you would a private invitation.

Server-validated writes

Creating events and saving availability go through server-side validation. Direct client access to the database is not the write path; policies are set to deny public table access, and application code performs authorized operations with the service role.

Bot protection

Write paths (event creation and availability save) use bot protection to reduce automated abuse.

Event pages and indexing

Event routes are marked so search engines should not index them. That reduces casual discovery via search; it does not replace keeping the link private within your group.

Retention

Events and related data are deleted 6 months after the event's last date, limiting how long names and availability remain stored.

Contact

Security questions: privacy@example.com. Operator: [TODO: operator].

Last updated: placeholder draft.