Security
Reporting a vulnerability
If you believe you have found a security vulnerability in Clubly, please tell us at privacy@clublyapp.com.
Include enough detail for us to reproduce what you found: the endpoint or screen involved, the steps you took, and what you observed. If you are unsure whether something is a vulnerability, send it anyway.
We will acknowledge your report within five business days and tell you what we intend to do about it. We will let you know when it is resolved. If you would like to be credited, say so and we will.
Good-faith research
We will not pursue legal action against anyone who reports a vulnerability to us in good faith, provided you:
- do not access, modify or delete data belonging to anyone other than yourself, or an account you have created for testing
- do not degrade or disrupt the service for other people
- give us a reasonable opportunity to fix the issue before describing it publicly
- do not use social engineering against our users, staff or suppliers
If you follow those principles, we will treat your report as authorised testing.
In scope
- clublyapp.com
- The Clubly iOS application
- The Clubly Android application
- The Clubly API
Out of scope
Denial-of-service testing, physical security, social engineering, and reports about services operated by third parties. Please report vulnerabilities in third-party services to the provider that operates them.
How Clubly handles your data
Clubly stores no payment card details. We do not collect them and they never reach our systems.
Clubly does not store passwords. Signing in uses a one-time code sent by SMS.
Tables holding user data are protected by row-level security, so that access to a record is decided per row rather than per table.
Data is held in a managed PostgreSQL database operated by Supabase Pte. Ltd, in a United States region, and is encrypted in transit and at rest by that provider. Transfers are governed by the Standard Contractual Clauses adopted under Commission Implementing Decision (EU) 2021/914.
For how we use personal data, and your rights over it, see our Privacy Policy.
Contact
privacy@clublyapp.com — security reports
privacy@clublyapp.com — privacy questions and data-subject requests