Security

otherthing separates private member records from versioned public projections. New Thing records may expose the member-provided name, rendered image, Met details and current value, while purchase price, receipt data and source files stay private. Authentication, authorisation and storage rules are enforced through the connected service as well as in the app.

Use entries are private by default. Show my uses exposes only eligible days to signed-in completed members while the owner chooses to share them. Notes, times, places and linked posts are never included; guests and blocked members cannot see use days.

We do not describe otherthing as independently audited, penetration-tested or security-certified. Those claims would require separate evidence.

• Member authentication through Sign in with Apple or controlled email registration.
• Row-level access policies separating owner-only records from approved public projections.
• Separate source images, device-local paths and receipts from rendered derivatives intended for public display.
• Newly rendered JPEG sharing copies with source metadata, precise location, filename and original path removed.
• Account-scoped blocking, content reporting and authenticated account deletion.
• Public Thing records are capability-gated. In a supported release, new records may expose the chosen Thing name, a rendered image, Met details and current value. Existing private records stay out of those projections unless the member separately agrees.

Use a strong, unique password if you register by email. Keep your device and operating system current, review content before publishing and remove access from a device you no longer control.

Capture metadata can be sensitive even when it does not contain precise GPS. Share only the context you are comfortable making visible to other members or guests.

Account email and authentication credentials, price paid, receipt images, source originals and their paths, serial numbers, unpublished drafts and the on-phone photo index are not part of a public Thing record. New Session posts are public; earlier participant-only Session posts retain their audience. Session Atlas stays limited to confirmed participants and the organiser.

Use the operator contact route and identify the message as an otherthing security report. Include the affected surface, the time observed, a concise reproduction path and the least sensitive evidence needed to understand the issue.

Do not access, alter or retain another person's data to prove a concern. There is no public bug-bounty or safe-harbour programme at this stage.