Skip to content
Party Games

Security Policy

Security Policy

1. Reporting a vulnerability

Report security issues privately to aleindiedev@gmail.com with the subject "SECURITY". Please do not open a public issue, post details on social media or disclose publicly before we have had a chance to fix the problem.

Include, if you can:

  • The app version and platform (Android / iOS) and the device and OS version
  • A clear description of the issue and its impact
  • Reproduction steps, proof-of-concept code or a screen recording
  • Any suggested mitigation

Please do not include real personal data of third parties in your report.

What to expect

Step Timeline
Acknowledgement of your report Within 5 business days
Initial assessment and severity triage Within 10 business days
Fix or mitigation plan communicated Within 30 days for high/critical issues
Public disclosure, coordinated with you After a fix ships, or 90 days from the report, whichever comes first

Party Games is maintained by a single independent developer. We have no bug bounty programme and cannot offer monetary rewards, but we will credit you in the release notes and in this page's acknowledgements if you would like that.

2. Safe harbour

If you make a good-faith effort to comply with this policy while researching a vulnerability, we will consider your research authorised, we will not pursue or support legal action against you, and we will work with you to understand and resolve the issue quickly.

Good faith means:

  • Testing only against your own devices and your own installation of the app.
  • Not accessing, modifying, exfiltrating or destroying data belonging to anyone else.
  • Not degrading the service for other users.
  • Giving us reasonable time to fix the issue before disclosing it.

If legal action is initiated by a third party against you for activity that followed this policy, we will make this authorisation known.

3. Scope

In scope

  • The Party Games Android and iOS applications as distributed by Google Play and the App Store.
  • The domain partygames.lanpage.co and the documents published on it.
  • Vulnerabilities allowing bypass of the in-app purchase entitlement check, tampering with locally stored data from outside the app's sandbox, insecure data handling in transit, or code execution.

Out of scope

  • Apple, Google, RevenueCat and other third-party infrastructure — report those directly to the vendor. RevenueCat: https://www.revenuecat.com/security
  • Vulnerabilities requiring a rooted, jailbroken, or physically compromised device, a malicious profile, or a debugger attached to the process.
  • Local access to the app's own data by the device owner. On-device data is protected by the OS sandbox and device encryption, not by additional app-level encryption, because it contains no sensitive personal data.
  • Denial of service, volumetric attacks, social engineering and physical attacks.
  • Missing security headers or best-practice findings on the static documentation site with no demonstrated impact.
  • Reports produced solely by automated scanners, without a working proof of concept.
  • The presence of the RevenueCat public SDK API key in the app binary. It is designed to be public; secret keys are never shipped in the app.

4. How we protect data

Our main control is that we collect almost nothing:

  • No user accounts, no passwords, no authentication secrets.
  • No backend server of our own and no database holding user data.
  • No analytics, advertising or tracking SDKs.
  • Player names, custom content and settings stay in the app's private sandbox on the device, protected by the operating system's app isolation and by full-disk encryption when the device is locked.
  • All network traffic — limited to purchase validation — uses TLS, enforced by the platform networking stack and the RevenueCat SDK.
  • Purchases are validated server-side by RevenueCat against Apple's and Google's receipt verification, not trusted from the client alone.
  • Release builds ship without debug logging of purchase internals.
  • Signing keys and store credentials are kept outside the repository, and no secret is committed to source control.
  • Third-party dependencies are kept to a small set and updated when security fixes are published upstream.

5. Supported versions

Only the latest version published on the App Store and Google Play receives security fixes. Security fixes ship as a normal app update; please keep automatic updates enabled.

6. Incident handling

If a security incident affects users, we will:

  1. Fix the issue and ship an update as quickly as the store review process allows.
  2. Publish a note in the release notes and on this page.
  3. Notify affected users and the competent data protection authority within the legally required deadlines if personal data is involved — in the EU/EEA, within 72 hours of becoming aware, as required by GDPR Art. 33.

7. Contact

aleindiedev@gmail.com · PGP is not currently available; if you need an encrypted channel, write to us and we will arrange one.

Effective date: 2026-09-17

Version history