Trust
Security
Updated October 11, 2026
How to report a vulnerability in Duoniva, and what protection the product does and does not provide.
1. Reporting a problem
If you believe you have found a security weakness in Duoniva, email hello@duoniva.com. Describe the issue, the steps to see it, and the date you found it. Please give us a reasonable time to investigate and fix it before you describe it in public.
Do not access another person's account, another couple's space, or data that is not yours. Do not run a test that degrades the service. We do not operate a paid bounty program.
2. What is protected
Traffic to duoniva.com and api.duoniva.com uses HTTPS. Passwords are stored as hashes. Invitation codes and session tokens are not written to logs in raw form. Message text is sealed on the device.
Story photos, albums, milestones, and time capsules are not end-to-end encrypted. Someone who can read the storage can read those files. Calls are not part of the product yet. A sealed message on one phone cannot be opened on a new phone with the current key design.