The report is written to a durable record before any notification is attempted, so a delayed or failed email cannot lose it.

Enforced by

app/api/contact/route.ts stores the submission first and only then makes a time-bounded notification attempt.

A person reads it. There is no automated triage queue and no bot deciding whether your report is interesting.

Enforced by

Reports arrive in the support@readyalready.org mailbox, which is monitored by hand.

If you would rather not use a form, the same details sent directly to the support address are equally welcome.

Enforced by

support@readyalready.org

A parent or caregiver signs in before reaching a private family library, and the app re-checks account ownership before returning any private book record, image, or file.

Enforced by

Route protection in proxy.ts, plus an ownership check inside app/api/images/[...path]/route.ts that returns 401 when the signed-in account does not own the book.

No storage URL is ever handed to the browser. Book images and PDFs are streamed through an authenticated route; the product issues no signed and no public storage links.

Enforced by

app/api/images/[...path]/route.ts and app/api/download/[...path]/route.ts download server-side and stream the bytes back as private, no-store responses.

Checked by

scripts/privacy-export-delete-proof.mjs asserts that no signed-URL call appears in the account data helper, so reintroducing one fails the proof.

The book buckets are created private and are forced back to private every time the migration runs, so an accidental flip cannot survive a deploy.

Enforced by

supabase/migrations/20260530234217_core_rls_storage_contract.sql sets public = false on insert and again on conflict, for both the image and the PDF bucket.

Row-level security is enforced at the database, not only in the app. A book row is readable only by the account that owns it, and a rating additionally has to prove the rated book belongs to the caller.

Enforced by

The same migration revokes the anonymous and signed-in roles across these tables and then re-grants narrowly, table by table.

Work that needs elevated database access runs only in server-only modules with session persistence disabled, so the elevated key cannot be bundled into anything a browser downloads.

Enforced by

utils/supabase/server.ts

Payment providers and app stores handle payment details; Ready Already does not store full card numbers.

Enforced by

There is no card-number field anywhere in the product's own interface. A web purchase redirects to the provider's hosted checkout, changing a card opens the provider's hosted billing portal, and in the apps the purchase happens in the store's own sheet.

Checked by

What the product stores is opaque references: a session identifier, a payment reference, an amount, a currency, and a status.

Purchase notifications are authenticated before they are trusted: one endpoint verifies a signature over the raw request body, the other compares a shared secret in constant time.

Enforced by

The webhook routes under app/api/webhooks reject an unsigned or mismatched request outright, and processed event identifiers are recorded so a replayed event cannot be applied twice.

Rate limits key on the account, the IP address, and the surrounding network block, and fail closed when the limiter backend is unavailable.

Enforced by

utils/api-rate-limit.ts

The native apps ship a no-tracking privacy manifest — tracking declared false, with an empty tracking-domain list — and suppress web analytics and advertising pixels entirely in the app runtime.

Enforced by

ios/App/App/PrivacyInfo.xcprivacy and lib/analytics/paid-media.ts

Checked by

test/ios-privacy-manifest.test.js and test/native-privacy-analytics.test.js

Error reporting is redacted deny-by-default before it leaves the device, with default personal-data collection off and session replay disabled.

Enforced by

lib/observability/sentry-scrubber.ts

Checked by

test/sentry-scrubber.test.js