How we keep HereNook safe

Signing in

• No passwords. You sign in with a code we email you, a passkey saved on your device, or your Google account. A code works once and expires after 10 minutes.
• A check for bots. Before we send any code, a quick, usually invisible check from Cloudflare makes sure a real person asked for it.
• Limits. We limit how many codes can be requested for one email address and from one network, so nobody can flood an inbox.
• Extra care for big changes. Deleting your account needs a recent sign-in. If yours is older, we ask you to confirm it’s you first.

Protecting your data

• Encrypted connections. HereNook and every Nook use HTTPS only, with modern encryption. Browsers are told to remember this, so they never fall back to an insecure connection.
• Encrypted secrets. Access tokens for accounts you connect (like Instagram or Facebook) and any API keys you add are encrypted before we store them. Sign-in codes are stored only in scrambled form.
• Private messages stay private. Messages people send through your Nook appear only in your HereNook inbox.
• A separate testing world. We test changes in a separate copy of HereNook with its own data. Testing never touches your account.
• Only who needs it. Only people who need access to run HereNook have it, and our internal tools sit behind an extra sign-in.

Keeping Nooks safe

• Their own address. Published Nooks live on gonook.io, apart from the place you sign in, so a page can never pretend to be a HereNook sign-in screen.
• Forms that check first. Enquiries, bookings and reviews check that a real person with a real email address sent them, and the bot check runs there too.
• Limits on messages. We cap how many messages can arrive and be sent, so a Nook’s inbox can’t be flooded.

Payments

Payments are handled by Stripe. Your card details go straight to Stripe. We never see or store your card number.

You stay in control

• Delete your whole account yourself from Settings → Danger zone in HereNook Studio.
• Disconnect Instagram or Facebook at any time. We delete the access token and stored posts straight away.
• Step-by-step instructions are on our Delete your data page.

Report a security problem

If you think you’ve found a security problem in HereNook, please email support@herenook.com with Security in the subject. Tell us what you found, where, and the steps to see it. We aim to reply within a few business days.

While you look into it, please:

• don’t look at, change or delete anyone else’s information. Use only accounts you own;
• don’t try to slow down or break HereNook, for example with heavy automated traffic;
• give us a reasonable chance to fix the problem before telling anyone else.