Security and Reliability

Account and Authentication Security

• Verifyam may use Firebase Authentication for login, registration, Google Sign-In, password reset, email updates, and email verification status.
• Users are responsible for keeping their email account, password, and device secure.
• Profile features may include display name editing, email editing, email verification, password reset, sign out, and delete account flows.
• Subscription plan display may be connected to the signed-in account and store purchase state.

Subscription and Entitlement Security

• Verifyam uses RevenueCat-style entitlement checks to determine whether the Pro entitlement is active.
• The app may listen for customer info updates, refresh backend subscription cache, restore purchases, and sync premium status.
• Store billing remains controlled by Apple App Store or Google Play. Verifyam does not directly collect full payment card details.
• Attempts to bypass Pro features, fake entitlements, or manipulate purchases may result in loss of access.

AI Verification Security

AI video missions use a live camera flow and backend verification to reduce fake dismissals. Security and integrity protections may include:

• Live camera recording instead of gallery upload for AI missions.
• Front and back camera switching when supported.
• Bright-light and action guidelines before recording.
• Network preflight checks before starting verification.
• Upload and verification status screens.
• Backend mission type validation before AI processing.
• Primary, secondary, and tertiary AI model fallback paths for verification reliability.
• Verification results containing status, confidence, reason, and model/provider information.
• Rejection of unclear, fake, old, unrelated, too dark, or incomplete videos.

Backend and Infrastructure

• A Cloudflare Worker backend may receive mission video payloads for AI verification.
• The backend may support multipart upload and JSON/base64 fallback for mission media.
• AI verification may use OpenRouter, Vertex AI fallback paths, or other AI providers configured for the app.
• Firebase Firestore and Remote Config may be used for account-related data, feature flags, and app configuration.
• Network status checks and offline indicators help users understand when cloud features may not be available.

Local Data Protection

Verifyam may use local storage such as AsyncStorage, MMKV, and app state management to store alarm settings, mission settings, sleep tools, offline content, subscription cache, and preferences. Local data helps the app remain useful during unstable network conditions. Users should protect their device with a passcode, biometric unlock, and current operating system updates.

Permissions and Why They Matter

• Notifications: alarms, wake-up checks, bedtime reminders, and status alerts.
• Exact alarms on Android: scheduling alarms more reliably on supported Android versions.
• Battery optimization settings: helping users reduce manufacturer restrictions that can silence or delay alarms.
• Display over other apps on Android: full-screen or locked-device alarm routing when supported and enabled.
• Background refresh on iOS: guidance for behavior that can affect app return checks and alarm flows.
• Camera: AI mission recording and barcode or QR scanning.
• Microphone, when requested by video APIs: video recording may request microphone access depending on platform behavior.
• Motion, activity, or sensors: steps, squats, shake-phone missions, and movement detection.
• Media, files, ringtones, or audio picker: custom alarm sounds and Android device ringtone selection.
• Network: login, subscription sync, AI verification, support, remote config, and app updates.
• Vibration and haptics: alarm vibration, mission feedback, and wake-up interactions.

Alarm Reliability Protections

• iOS notification permission flow.
• iOS alarm permission flow where supported.
• iOS background refresh guidance.
• Android notification permission checks.
• Android exact alarm scheduling checks.
• Android battery optimization guidance.
• Android display-over-apps guidance.
• Permission banners when alarm permissions are missing.
• Deep-link handling for alarm and wake-up-check screens.
• Native active alarm state polling.
• Locked-device alarm routing.
• Foreground notification handling.
• Background app return checks.

These protections improve reliability, but they do not remove all device and operating-system limits. Keep a backup alarm for critical events.

Data Minimization and User Control

• AI mission media is used for verification, not for creating a personal video gallery.
• Users can turn off optional permissions, though related features may stop working.
• Users can delete alarms, edit routines, sign out, restore purchases, reset passwords, and request account deletion.
• Custom sounds can be deleted when the app feature supports it.

Security Practices

• Use platform app stores for distribution and purchase handling.
• Use provider-managed authentication and subscription systems rather than collecting payment card details directly.
• Validate AI mission type and return structured verification responses.
• Use network preflight and error handling for unstable network conditions.
• Use an app-level error boundary and startup crash fallback screen where implemented.
• Clean up old history and handle offline conditions when supported by the app.

Responsible Disclosure

If you believe you found a security vulnerability, please contact us before publicly disclosing it. Include affected feature, device model, operating system version, app version, steps to reproduce, screenshots or logs if safe to share, and your contact information.

Report security concerns to info@verifyamaialarm.com.