Pactly Security & Data Protection

Pactly is a small-group accountability platform operated by Ghaith Labs. We designed Pactly to help friends and trusted peers achieve shared goals while maintaining clear, enforced boundaries around user privacy and message confidentiality.

For an overview of studio-wide infrastructure security, visit the Ghaith Labs Security Practices page.

1. Data Architecture & Group Privacy Boundaries

Pactly isolates information strictly according to user permissions and pact memberships:

  • Pact-Scoped Visibility: Within a pact, fellow members can view your chosen display name, profile photo, check-in completion status, and optional check-in notes.
  • Private Encouragement Messages: Private notes are shown only to their sender and recipient, not other pact members or organizers. Authorized safety reviewers can inspect a server-captured copy when a note is reported. Cheers on a check-in are visible within that pact.
  • Private Account Information: Your account email address, authentication credentials, and personal notification preferences remain private to you and are never disclosed to other members or pact creators.
  • Organizer Reminders: Organizers may receive inactivity reminders about you as a fallback recipient or after a longer period of inactivity. These alerts can identify you and describe your inactivity, and are not necessarily sent to every member. The current App has no option to prevent all such organizer reminders while you remain in the pact. See the Privacy Policy.
  • Selected Photos: Pactly processes the image you choose for a pact photo without requiring your entire photo library. It does not request contacts, GPS location, camera or microphone access. Product analytics and content safety processing are explained in the Privacy Policy.

2. Authentication & Credential Security

  • Secure Identity Providers: Pactly uses Firebase Authentication to support sign-in with Apple, Google, or email and password.
  • Password Authentication: The App passes the password you enter to Firebase Authentication to sign you in or create your account. We do not store your password in Pactly's application database; Firebase Authentication manages password verification.
  • Session Integrity: Authentication states are secured with short-lived session tokens and secure cryptographic token refreshes.

3. Backend & Infrastructure Safeguards

Pactly runs on modern cloud infrastructure provided by Google Firebase:

  • Transport Encryption: All data transmitted between the client application and cloud servers is encrypted using standard HTTPS / TLS protocols.
  • Granular Database Security Rules: Cloud Firestore security rules strictly enforce access boundaries at the database level. Queries without verified membership in a specific pact are rejected by the database.
  • Serverless Execution: Push notifications (delivered via Firebase Cloud Messaging) and group integrity logic run within isolated Cloud Functions.

4. Data Retention & Account Deletion

You retain full control over your account data:

  • Self-Service Account Deletion: You can delete your account at any time within the app under Profile → Privacy & Account, or by emailing dydemiryasir@gmail.com.
  • Deletion Scope: The server removes your profile, settings, memberships, check-ins and notes, sent and received private encouragements, cheers, invitations you created, and Pactly's paid-access record before deleting your sign-in account and confirming success. There is no 30-day waiting period for these records. Shared pacts with other members, including their goal and pact photo, remain; another member takes over as organizer when needed. If the pact is deleted, a separate background process removes its stored photos and uploads.
  • Token Pruning: Inactive push notification tokens are automatically removed.
  • Records Outside Account Deletion: Reports are scheduled for cleanup after 30 days. The reporter account link is removed on account deletion; retained evidence may still contain reported content until cleanup. Historical analytics events and their identifiers, operational logs, submitted feedback, and provider billing records are not erased by the account-deletion process. See the Privacy Policy for details and deletion requests.

5. Reporting Security Concerns

If you have questions about Pactly's data security or need to report a vulnerability, please reach out to our team:

Ghaith Labs / Contact

Let’s talk.

App support, feedback, or a product question. Your message comes straight to me.

Sent privately to dydemiryasir@gmail.com. Want a reply? Include your email above.