Security and your data

What is protected, and what is only hidden.

Some of what follows is enforced by the server, which means it holds no matter what any browser asks for. Some of it is the app choosing what to display. Those are different promises, and this page keeps them apart.

Enforced by the server

One renovation cannot see another.

Every read and every write is checked against a membership record for that specific project. Being signed in is not access; being a member of one project grants nothing in another. Somebody with no membership gets nothing at all, and that is decided on the server rather than by the app on your screen.

Checked by a test suite

335 automated tests run the rules against a real database and assert what each kind of person can and cannot do, including strangers and signed-out visitors. They run before any change to the rules ships.

Roles are enforced, not suggested

A designer or contractor can change exactly one thing about an item: whether it has been delivered. An attempt to change that and the price together is rejected outright rather than partly applied.

An invitation is not a key

An invitation grants nothing by existing. It is checked when it is claimed, and only for the address it was sent to, on an account that has confirmed that address by email.

Hidden from view

What a designer sees, and what reaches their browser.

Prices, payments, who paid and receipt links are kept out of a designer's and a contractor's view, and the documents section is not shared with them at all. Two of those are different in kind, so here is the distinction the app itself draws on its own settings screen.

The documents section, and receipt files

Genuinely denied by the server. A functional role asking for them is refused, whatever their browser does.

Prices, payments and who paid

Hidden from view rather than withheld. They live on the same record as the item's name and room, which a designer legitimately reads, so the data is present in their browser even though no screen shows it. Somebody technical could find it there.

The Roles settings tab for the designer role, with two columns. One is headed Access, enforced by the server — turning these off actually denies access. The other is headed What they see, hidden from view. The data may still be technically accessible. — The app draws the same line on the screen where you set these, in the same words.

This is why the roles are described as discretion rather than confidentiality. They are the right tool for a collaborator who should not be shown the budget. They are not the right tool if somebody must provably never learn it.

Your data

You can take it out, and you can destroy it.

Both are in the app, not in a support queue.

Export, whenever you want

A zip with your items as a spreadsheet, plus your documents and receipts. The download link works for seven days and the copy is then deleted, because an export is a second copy of everything and should not sit around being one.

Deletion that actually deletes

Deleting a project removes every item, document, category, room, payer and uploaded file. One thing is deliberately kept: the record that a payment was made, which is an accounting obligation rather than renovation data. The screen says so before you confirm.

The Danger Zone panel in project settings, warning that deleting the project removes every item, document, category, room, payer and uploaded file permanently, that everyone invited loses access, that this cannot be undone, and that the record of what was paid is kept. — The wording in the app, before you confirm.

Payment

Your card never reaches us.

Payment is handled entirely by Stripe, on Stripe's own pages. YPReno never sees or stores a card number, and there is nothing here for a card to be stolen from. What is kept on this side is which plan a project is on and when its access runs to.