Authenticated ownership
Protected requests use validated account tokens, and ownership comes from that identity—not an email address or user ID supplied in a request body.
Trust / Security
Protect the data.Minimize the blast radius.
A plain-language view of the safeguards built into Moow and the channel for reporting a suspected security issue.
Report a security issue01 / Security postureLast updated
September 19, 2026
September 19, 2026
Specific controls.No empty badges.
Moow treats measurements, goals, meals, workouts, health signals, photos, AI conversations, and community settings as private. The system is designed to keep that content out of URLs, object names, routine logs, analytics, and support tickets.
This page is an architecture overview, not a claim of formal certification, regulatory status, a completed penetration test, or a public bug-bounty program.
Defense in layers.
Private storage
Private member images use owner-scoped storage paths that avoid email addresses and health details. Public editorial images are intentionally public. Data-copy requests currently go through support.
Minimized telemetry
Operational monitoring is designed to exclude request bodies, access tokens, refresh tokens, health values, AI prompts, private photos, and meal history.
Deletion fences
Account, chat, provider, and upload deletion flows use guarded state so stale requests cannot silently restore content after deletion.
Authentication and authorization
The API validates protected sessions before accepting a request. Account-owned records and private object paths are scoped to the authenticated user; authorized administration and shared community features have separate access rules.
Uploads
Private uploads use bounded file types and sizes, owner-scoped paths, completion checks, and cleanup for abandoned or released files. A client-supplied remote image URL is not accepted as a private meal-photo source.
Providers and secrets
Database credentials, provider secrets, signing keys, and the OpenAI key stay in server or deployment secret stores. The mobile app calls the authenticated Moow API rather than receiving those credentials.
Monitoring and incidents
Operational reporting uses bounded event types, request IDs, and counts while application payload capture is restricted. Infrastructure still receives connection information. Release procedures include rollback and account-boundary checks; monitoring and backups reduce risk but cannot guarantee that every incident will be prevented or detected.
Report a vulnerability
Email hello@moow.ai with “Security report” in the subject. Include the affected URL or feature, impact, and safe reproduction steps. Do not access another person’s data, degrade the service, use automated high-volume testing, or publish private information.
Moow does not currently advertise a paid bug bounty. Good-faith reports will be reviewed through the security channel.