Skip to content

Security and Vulnerability Disclosure

Effective: October 20, 2026 · Last updated: October 2026

8 sections, about 3 minutes to read

Curtains is operated by Billion Flower Moon Studios LLC, a Wyoming limited liability company.

If you've found a security problem in Curtains, we want to hear about it. This page explains what's in scope, how to report, how to test in good faith and what we'll do.

1. Scope#

In scope:

  • the Curtains iOS app
  • the Curtains API, the servers the app talks to
  • our website, curtainsdating.com

A problem in how we've set up a service we use (for example, a storage bucket we've left open) is in scope.

Out of scope:

  • problems in other companies' services themselves, including Apple's and those of the cloud, network, analytics, email and phone providers we use. Report those to the company concerned.
  • denial-of-service attacks, and load or stress testing
  • social engineering of members or of the people who run Curtains, such as phishing, and physical attacks
  • spam, and content that breaks our Community Guidelines
  • automated scanner output without a working proof of concept
  • missing best-practice settings with no demonstrated security impact, such as missing HTTP headers or email authentication (SPF, DKIM, DMARC) settings

2. How to report#

Email security@curtainsdating.com, in English, with:

  • what you found and where (app version, API endpoint or URL)
  • steps to reproduce it, and a proof of concept if you have one
  • what an attacker could do with it
  • how to reach you, and whether you'd like to be credited

Please report as soon as you can after you find something. Don't include members' personal information beyond what's needed to show the problem.

3. Test in good faith#

  • Use only your own accounts. To test anything between members, use two accounts of your own.
  • Leave real members alone. Don't like, match with, message or report anyone else's account.
  • Don't touch other people's data. Don't access, change, delete or keep it. If you come across someone else's data, stop, don't save or share it, and tell us.
  • Do only what you need to show the problem.
  • Don't disrupt Curtains: no denial of service, high-volume automated testing or spam.
  • No social engineering and no physical attacks.
  • Tickets. If you find a way to get Tickets without paying, stop and tell us. Tickets gained through a bug can be taken back.
  • Keep it private until we've fixed the problem or agreed on a date with you (section 5).
  • Don't demand payment. Asking for money in exchange for not publishing isn't good faith, and this policy doesn't cover it.

4. If you act in good faith#

If you follow this policy in good faith:

  • we consider your research authorized, and we won't take legal action against you or report you to law enforcement because of it;
  • we won't use anti-hacking or anti-circumvention laws, such as the Computer Fraud and Abuse Act or the Digital Millennium Copyright Act, against you for it;
  • if our Terms would otherwise forbid something you need to do for that research, such as reverse engineering the app, we waive that restriction for research that follows this policy; and
  • if someone else takes legal action against you over research that followed this policy, we'll make it known that we authorized it.

This covers Curtains only. We can't authorize testing of other companies' systems. If you're not sure whether something is allowed, ask us at security@curtainsdating.com before you do it.

5. What we'll do#

  • We aim to confirm we've received your report within 3 business days.
  • We'll tell you whether we can reproduce the problem, and what we plan to do about it.
  • We'll keep you updated, and tell you when it's fixed.
  • We ask you to give us up to 90 days from your report to fix it before you publish anything. If we need longer, we'll explain why and agree on a date with you.
  • With your permission, we'll credit you on this page once it's fixed.
  • If the problem exposed members' personal information, we'll notify the people affected as the law requires.

6. No bounty#

We don't pay bounties or other rewards for reports.

7. Not a security problem?#

8. security.txt#

We publish this file at https://curtainsdating.com/.well-known/security.txt:

Contact: mailto:security@curtainsdating.com
Expires: 2027-10-19T23:59:59.000Z
Policy: https://curtainsdating.com/security
Preferred-Languages: en