Security Policy
Universal AI LLC (the company behind Jineo) welcomes security researchers who help us protect our users. This page documents what's in scope for disclosure, how to report a finding, and what response timelines you can expect from us.
How to report
- Email security@universalaillc.com with a clear write-up.
- Or open a private security advisory at GitHub Security Advisories.
- Preferred languages: English, Korean (한국어).
- Please give us 90 days to investigate and fix before any public disclosure.
What we commit to
- Acknowledge your report within 24 hours (business hours, US Eastern).
- Triage and confirm severity within 7 days.
- Fix or mitigate any confirmed vulnerability within 90 days of triage, or sooner if severity warrants.
- Credit you on our researcher acknowledgments page unless you prefer anonymity.
- Not take legal action against good-faith research that follows this policy.
In scope
- The Jineo iOS app (bundle ID
com.universalai.jineo) — current App Store version and the latest TestFlight build. - The Universal AI LLC website at universalaillc.com.
- The Jineo Supabase backend at project
eelywdeipkraxgxtpfry, including all edge functions underhttps://eelywdeipkraxgxtpfry.supabase.co/functions/v1/. - The Jineo OTA bundle on EAS Updates.
Out of scope
- Findings that require a jailbroken iPhone, an attacker with physical access, or installation of a custom root CA.
- Social engineering of Universal AI employees, contractors, family, or customers.
- Denial-of-service attacks (rate limiting and DDoS testing).
- Spam, phishing, or content-moderation failures (use the in-app report flow for content concerns).
- Self-XSS, missing security headers without demonstrated impact, or missing rate limits on endpoints that already enforce them server-side.
- Vulnerabilities in third-party services we use (Supabase, RevenueCat, OpenAI, ElevenLabs, PostHog, Sentry, Resend) — please report those to the vendor.
- Findings already disclosed publicly elsewhere.
- Outdated dependency versions without a working PoC against our deployment.
What to expect from us
We do not currently run a paid bug bounty. This is a Vulnerability Disclosure Policy (VDP) — we'll acknowledge your report, credit you, and fix the issue, but we do not pay monetary rewards yet. Once Jineo crosses 1M monthly active users, we plan to open a paid program on HackerOne; researchers from our VDP era will be invited first.
Your right to delete your data
Per GDPR Article 17 and CCPA §1798.105, you can permanently delete your Jineo account and all associated data at any time:
- In-app — Profile → Privacy → Delete account (one-tap, immediate)
- By email — security@universalaillc.com (we respond within 48 hours, complete within 30 days)
Once deletion is initiated, the following happens automatically:
- Immediate — All app data (scans, routines, social graph, email subscription, Pro/Studio entitlements) is permanently deleted from our active database
- Within 30 days — All Supabase backups containing your data are purged through normal retention rotation
- Apple-managed — Your subscription billing history is managed by Apple Inc. and is not in our control; manage it at Settings → Apple ID → Subscriptions on your device
- Anonymized usage logs — Aggregate analytics (PostHog events without your user_id) may persist indefinitely but cannot be linked back to you
Subprocessors
Vendors that process Jineo user data on our behalf, with whom we have signed Data Processing Agreements (DPAs) per GDPR Article 28:
- Supabase (storage, auth, edge functions — US-east region)
- OpenAI (skin analysis — zero retention per their API policy)
- RevenueCat (subscription billing)
- ElevenLabs (Hana voice synthesis)
- Sentry (crash reporting — PIPA-gated, opt-out available)
- PostHog (product analytics — anonymized when feasible)
- Resend (transactional email)
- Google Workspace (security@ inbox routing)
- Apple Inc. (App Store distribution + subscription billing)
- GitHub (code hosting + security advisories)
All US-based subprocessors operate under EU Standard Contractual Clauses (SCCs). We update this list within 30 days of any change. See our privacy policy for full details on data handling.
Safe harbor
We consider security research conducted under this policy to be authorized, conducted in good faith, and exempt from claims under the Computer Fraud and Abuse Act (CFAA), the Digital Millennium Copyright Act (DMCA), and Apple's Developer Program License Agreement. We will not initiate legal action against researchers acting in good faith.