Skip to content
Sign in

Security

Security

How we protect your family's data, and how to tell us if you find a weakness.

Last updated: November 14, 2026EnglishTürkçe

  1. 1How we protect your data

    • All traffic between the apps, the web panel and our servers is encrypted in transit.
    • Passwords and security answers are stored only as one-way hashes. Sign-in codes expire quickly and wrong attempts are limited.
    • Every request is checked on the server against the family it belongs to: one family can never read another's data, and a child can see only their own.
    • Each parent has their own sign-in. Sessions are tied to a device, devices can be removed from settings, and a new-device sign-in is reported by email.
    • Pairing codes are single-use and expire within minutes; a child's device can be removed at any time.
    • Forms and sign-in are protected against bots with Cloudflare Turnstile.
    • On Mac and Windows, Koby's keys are kept in the system's secure store (Keychain or DPAPI). Error reports are scrubbed of names and paths before they leave the computer.
    • Koby staff access personal data only to help with a request you made or to keep the service secure.

    We do not claim certifications we do not have. What we collect and for how long is in the privacy policy.

  2. 2Responsible disclosure

    If you believe you have found a security vulnerability in Koby, please report it to . Include what you found, where you found it, the steps to reproduce it and its possible impact. Please write in English or Turkish. We will confirm receipt, keep you informed while we investigate and fix it, and credit you if you wish once it is fixed.

    Safe harbour. We will not take legal action against research done in good faith that follows the rules below. If in doubt, ask us first.

    • Use only your own accounts and test families. Never access, change or keep other people's data, and especially not children's data. If you reach personal data by accident, stop, and tell us.
    • No denial of service, spam, social engineering of our staff or users, or physical attacks.
    • Do not publish or share the issue until we have fixed it, or until 90 days have passed, whichever is sooner, unless we agree otherwise.
    • Give us reasonable time to fix the issue before any disclosure.

    We do not run a paid bug bounty programme at the moment. Our security contact is also listed in security.txt.

  3. 3Keeping your account safe

    • Use a password you do not use anywhere else, or Sign in with Apple.
    • Never share your sign-in or a pairing code; invite a second parent instead.
    • If you get a new-device email you don't recognise, change your password and remove devices you don't recognise in Settings › My devices.