VOXFLOW / SECURITY

Security

What VoxFlow collects, what it does not, and how to report a vulnerability.

14 / VF—2026
NOT READY FOR PUBLICATION

Legal identity fields are missing. This is an engineering draft for legal review.

Principles

Argon2id passwords, opaque sessions, Ed25519 entitlements, OS safeStorage and ciphertext-only sync.

Not collected

Screenshots, URLs, active-field contents, accessibility trees, contacts and browsing history are not collected.

Report a vulnerability

Send a reproducible report to the security email. Do not expose other users’ data and allow reasonable remediation time.

Contact and owner

__REQUIRED__
Tax ID: __REQUIRED__
__REQUIRED__
__REQUIRED__