How CtrlApp protects your app

• Dashboard accounts sign in over email + password or Google; sessions are managed by Lovable Cloud auth.
• Every destructive control-plane action (kill-switch, rollback, delete, bulk import) requires an editor or higher role on the target app and is recorded in an immutable audit log.
• Platform roles (super_admin / admin) exist for operator support and are logged the same way.
• SDK requests authenticate with per-app API keys. Keys can be scoped (read / write / admin), rate-limited per key, and revoked instantly without redeploying an app.

• All API traffic is served over TLS.
• Inbound webhooks require HMAC-SHA256 signatures with a timestamp window and per-request nonce; replays are rejected.
• Cron and internal callers require a dedicatedCRON_SECRET bearer token; the public anon key is not accepted for privileged endpoints.

• Device install / open events, platform, OS version, app version, locale, timezone, and a stable device UID minted by the SDK.
• IP address collection defaults to off. App owners can opt in to a pseudonymous mode where each IP is hashed with a per-app secret salt (HMAC-SHA256), so the same IP cannot be linked across apps.
• No end-user credentials, no message contents, no payment data, and no advertising identifiers pass through CtrlApp.

• Analytics events, flag impressions, and SDK request logs are automatically pruned on a 90-day rolling window.
• IP-history retention is configurable per app (default 30 days, max 365) and enforced by a scheduled purge job.
• Audit log retention is configurable per app and enforced by a scheduled purge job.
• Account or app deletion removes all associated tenant data; point-in-time backups from the underlying platform age out according to Lovable Cloud policy.

• Lovable Cloud — hosts the database, auth, storage, edge workers, and dashboard for CtrlApp.
• Resend — transactional and notification email delivery.
• Push notification providers are configured per app-owner and use the app owner's own credentials — CtrlApp does not hold end-user push tokens for apps not enrolled in the push module.
• Additional integrations (webhook destinations, form delivery targets) are configured explicitly per app owner; nothing sends data outbound by default.

End users of apps built on CtrlApp should submit privacy requests to the operator of that app in the first instance — the app owner is the controller of end-user data. CtrlApp acts as a processor and will assist app owners in fulfilling deletion, export, and rectification requests.

To request deletion of your CtrlApp account data, email privacy@ctrlapp.krdcode.com.

We appreciate coordinated disclosure. Please email security@ctrlapp.krdcode.com with a description, reproduction steps, and any proof-of- concept. Do not run automated scanners against production traffic and do not access data belonging to other tenants.

A more formal disclosure policy will be published at /.well-known/security.txt when the private beta concludes.

CtrlApp does not currently claim SOC 2, ISO 27001, HIPAA, or PCI compliance. Statements about GDPR, CCPA, or other regulatory frameworks will be added here after review by qualified counsel; contact us for the current state before onboarding regulated workloads.

Real-time operational status is at /status. Uptime monitors can poll /api/public/ready for a deep DB check or /api/public/health for a lightweight liveness check.

• Security: security@ctrlapp.krdcode.com
• Privacy: privacy@ctrlapp.krdcode.com
• General: hello@ctrlapp.krdcode.com