Security
The most secure data is the data we never take.
This is a site with almost no moving parts, and we keep it that way on purpose. Here is exactly what runs today, how to report a problem, and what launch will add.
What is served today
Small surface, strict rules.
Static by design
- Every marketing page on this site is a static page. Accounts exist and are open by invitation; the account surface is the app at /app-next/ and a small set of api/ endpoints, each described below and each behind its own checks.
- The waitlist form goes to the waitlist endpoint (a form-delivery service that relays your entry to us). Beyond that, the only network calls are the cookieless analytics beacons, described in the privacy policy.
- The waitlist asks for your email address and your consent, nothing else. With it we record the consent time, the policy version (waitlist-2026-08-v1) and which page you joined from. No due date, no stage, no child's name, no browser language.
Locked-down responses
- A strict Content-Security-Policy is enforced on every page of the new site through a policy delivered in the page itself, limiting what the browser is allowed to load and run. The preserved legacy pages currently run a report-only header policy while their migration finishes, and this page says so instead of rounding up.
- Security headers ship with every page, not just the front door.
Nothing watching you
- No third-party script origins. Everything the page runs is served from our own domain, the analytics script included.
- No cookies on any page. Every page counts views through cookieless PostHog served from our own domain, and guide, tool and blog pages also carry Vercel's performance beacon, both disclosed in the privacy policy. We cannot leak tracking data we never collect.
How to report
Found something? Tell us directly.
Report a security issue
Email hello@leelalu.com with the subject "Security". Include what you found and how to reproduce it. We answer within two business days, and a real person on the team reads it, not a queue.
No bug bounty yet
We do not run a bug bounty program yet, and we would rather say that plainly than imply a reward we cannot pay. What we do promise: a direct answer, credit if you want it, and a fix when one is needed.
What launch will add
Planned for launch. Not shipped today.
Some of this section has shipped: accounts are live by invitation, each family's data is isolated by row-level security, and deletion and export work from inside the product. The rest remains planned, and each card says which it is.
Planned
Isolated family accounts
Authenticated accounts where each family's data is isolated from every other family's. One household, one boundary.
Planned
Encryption everywhere
Encryption in transit and at rest for family data, so it is protected both on the wire and on disk.
Planned
Export and delete in one click
Your data leaves with you: export everything, or delete everything, in one click from inside the product. Until then, one email to hello@leelalu.com deletes your waitlist data within 7 days.
Facts on this page are checked against release-facts.json. Build 27e9ec2 · composed 2026-09-22.
LEELALU