How we protect your data

Infrastructure

Fairway VS is hosted on Google Cloud through Firebase.

Data is encrypted in transit with TLS and encrypted at rest by Google.

Payments

Card data for trip passes is handled entirely by Stripe. We never see or store card numbers.

League data stays in the league

Database security rules restrict each league's data to that league's members. An automated test suite checks those rules on every code change.

Sign-in

Sign-in runs on Firebase Authentication, with email and password, Sign in with Apple, or Google. We never see your password.

Our own access

Administrative access to our systems is protected by two-factor authentication.

Report a vulnerability

Email security@fairwayvs.com with a description of the issue and the steps to reproduce it. The same contact is listed in our security.txt file.

Good-faith research is welcome. When you test, please:

• Give us a reasonable amount of time to fix the issue before you disclose it publicly.
• Use only your own accounts and leagues, and don't access, change, or delete other people's data.
• Don't degrade the service for others, for example with denial-of-service testing.
• Don't use social engineering or phishing against our users or team.

We don't run a paid bug bounty program.