Sofra Sofra
Trust

Security & data protection

Sofra holds something personal — your family's food life. Here's how it's protected, in plain terms.

Authenticated access

Every request requires you to be signed in via Google Sign-In or email/password, handled by Google Firebase Authentication. No anonymous access to data.

Household-scoped

Meals, dishes, and restaurants live under your household and are readable only by its members. Server-side security rules enforce this — not just the app.

Encrypted in transit

All data travels over HTTPS/TLS between your device and Google's servers.

Photo safeguards

Profile photos are stored per-user; only you can upload or replace your own, and uploads are limited to images under 1 MB.

You control your data

Edit or delete any meal, dish, or photo anytime. Delete your account from Settings to remove your personal data.

Never sold

We do not sell your personal information, and there are no third-party advertising trackers in the app.

Under the hood

How the rules actually work

Access is enforced by server-side security rules on the database and file storage — the app can't bypass them, and neither can anyone else.

  • Users can read and edit only their own profile and preferences.
  • Households are readable by signed-in users (needed for invite-code joins); only the admin can change settings or delete the household.
  • Meals, dishes & restaurants are readable and writable only by members of that household.
  • Everything else is denied by default — an explicit deny-all rule backstops the whole database.
  • Avatars in file storage: anyone signed in can view (for member lists), but only the owner can upload, replace, or delete their own — and only image files under 1 MB.

Minimal permissions

The Android app requests only what it uses — internet, notifications, camera and photo access for meal/profile pictures. It does not request "draw over other apps," device admin, location, contacts, SMS, or call permissions.

Responsible disclosure

Found a security issue? Please email [email protected] and we'll respond promptly.