Coinsprout
Security

Small data, locked doors, plain language.

Coinsprout holds family data, so we keep as little as we can and protect what we keep. This page explains how, without jargon. If you find a hole, we want to hear from you first.

Report a vulnerabilityYour data
Practices

What we do, in order of how much it matters

  • Encryption in transit

    Every page and every API call runs over HTTPS. Plain HTTP is redirected. Connections to our database and to model providers are encrypted too.

  • Passwords hashed with bcrypt

    We never store a password, only a bcrypt hash with a per-password salt. If our database were copied, there would be no passwords in it to read.

  • Parent-only sessions

    Only parents have logins. Sessions are HTTP-only, same-site cookies that expire. Child mode runs inside a parent session and cannot reach Settings or billing.

  • Kid mode isolation

    Child mode has no account controls, no external links, and no way to call a model provider directly. Everything a kid can do goes through our server with the parent's session attached.

  • Least-data principle

    We collect a parent email, a child nickname and age band, and mission results. Nothing else. The best way to protect data is to not have it.

  • Provider keys stay on the server

    API keys for model providers and for payments live in server-side environment variables. They are never shipped to a browser and never written to logs.

  • Dependency updates

    Dependencies are reviewed and updated on a weekly cadence, with automated alerts for known vulnerabilities and a same-week fix policy for anything rated high.

  • No third-party ad or tracking scripts

    There are no ad networks, no social pixels, and no analytics scripts from outside companies on any page. Fewer scripts means a smaller attack surface and a cleaner promise to parents.

Responsible disclosure

Found something? Tell us first.

If you believe you have found a security issue in Coinsprout, email security@coinsprout.tech with enough detail for us to reproduce it. Our CTO reads that inbox directly.

What we ask

  • Give us a reasonable window to fix the issue before you publish anything.
  • Do not access, modify, or delete data that is not yours, including test data belonging to other families.
  • Do not run automated scanners against child mode or the public demo at a rate that would affect other users.
  • Never attempt to interact with a real child's profile. Create your own parent account and child profile for testing.

What you can expect

  • An acknowledgment within two business days.
  • A status update at least weekly until the issue is resolved.
  • Credit by name on this page, if you want it, once the fix ships.
  • No legal action against good-faith research that follows the rules above.

In scope

coinsprout.techParent appMission APIPublic demoBilling flows

Out of scope

Third-party providersDenial of serviceSocial engineeringPhysical office access

We do not run a paid bounty program yet. We do send thank-you notes, Coinsprout stickers, and a line on this page.

Security is one piece of the stance.

Read how the AI is boxed in, what we store about children, and how to export or delete everything.

Parents and SafetyPrivacy policy