SecuritySecurity

Encryption

All traffic between the Layne app (and this website) and our servers is encrypted in transit using TLS/HTTPS. Data at rest — in our database and file storage — is encrypted using the standard encryption-at-rest provided by our infrastructure provider, Supabase, which runs on managed Postgres.

Chat messages are not end-to-end encrypted. Chat messages are encrypted in transit and at rest using standard cloud infrastructure encryption, but are not end-to-end encrypted — this means Layne's systems can technically access message content, for example to investigate abuse reports. We do not currently offer end-to-end encryption for chats.

Access control

Layne uses row-level database security policies so that, by default, users can only read and write their own data through the app — not other users' private data. This is enforced at the database layer itself, not only in application code, so it holds even if a bug existed in the app.

The public-facing API key used by the app and website has column-level and row-level restrictions. It cannot read or write arbitrary data — only what each specific feature is permitted to touch.

Authentication

Layne uses email-based one-time-passcode (OTP) sign-in. There are no passwords stored for user accounts, which removes an entire class of credential-stuffing and password-reuse risk that comes with password-based logins.

Face verification

Verification starts with an on-device liveness check — you're asked to blink, turn your head, and hold still and look at the camera — plus an on-device anti-spoofing model, before any image is ever sent off your device.

The captured still image is then sent to Layne's systems, compared exactly once against your profile photo using Amazon Rekognition (a third-party face-comparison service), and then deleted once verification completes.

No face template, faceprint, or biometric embedding is ever stored. Only a yes/no verification status and a timestamp are kept after the comparison. There is no facial-recognition database or watchlist — each comparison is a one-time, one-to-one check against your own profile photo, not a search against other users. Most face-verification systems keep a stored biometric template; Layne's doesn't.

Media deletion

Mood Feed posts are live for 24 hours. The underlying post photos and voice notes are permanently deleted from storage 7 days after the post expires.

What we don't currently offer

We'd rather tell you the limits directly than let you assume more than what's true:

• No end-to-end encryption for chats. As above, message content is protected by standard encryption, not end-to-end encryption.
• No independent third-party security audit or penetration test has been completed yet.
• No bug bounty program exists yet.

Reporting a security issue

If you discover a security vulnerability, contact support@joinlayne.com. We don't yet have a dedicated security contact or a formal responsible-disclosure program, but we take reports seriously and will respond.