Security
How we handle your data.
This page names our concrete choices, so you can decide whether we're the right platform for your training history. Not marketing — engineering.
Controls we ship
Encryption in transit and at rest
TLS 1.3 between every client and our API. D1 (SQLite) and R2 storage are AES-256 encrypted at rest by Cloudflare. Media in R2 is served through signed URLs with short expiries.
Passwordless authentication
Magic-link email sign-in or Sign in with Apple / Sign in with Google. No passwords for us to leak. Sessions rotate on a schedule; you can revoke every session in Settings.
Least-privilege permissions
Coach access is enforced in SQL, not in the UI. A hidden panel isn't privacy — a database rule is. Six client-owned toggles gate what a coach can see; downgrading a permission takes effect on the next request.
AI is gateway-mediated
Every AI call goes through a gateway that logs the model, tokens, latency, and cost. Per-account quotas prevent surprise usage. Kill switches disable a single feature, a single account, or every AI feature globally.
One-tap export and delete
Settings → Data → Export ships a portable .maxtopia file with your entire training history. Delete My Account nukes rows, empties R2 for you, and sends a receipt. Legal-hold buckets exist only for regulatory retention that we explicitly disclose.
No product analytics on personal data
We use Cloudflare Web Analytics for the marketing site (no cookies, no cross-site tracking). No mixpanel, no amplitude, no segment. The app collects crash reports; you can turn those off.
Where your data lives
Maxtopia runs entirely on Cloudflare — no AWS, no GCP, no ad-tech-adjacent hosting. The whole stack is auditable in our public infrastructure config.
Compute
Cloudflare Workers (edge, worldwide)
Database
Cloudflare D1 (SQLite, regionally durable)
Object storage
Cloudflare R2 (S3-compatible, no egress fees)
KV / sessions
Cloudflare KV (eventually consistent, edge-cached)
Queues
Cloudflare Queues (durable, exactly-once semantics per producer)
CDN + WAF
Cloudflare (proxied, HTTPS-only)
If something happens
A security disclosure or a suspected breach: security@maxtopia.app. Coordinated disclosure welcome; we\'ll credit you in the changelog.
If we discover an incident that affects your data, we contact you at the email on your account and post an incident report on the changelog. No hiding behind "we were the victim of a sophisticated attack" — the report names the failure mode and what we did.
Read the details.
The privacy policy explains exactly what we store and why. The terms cover what we won\'t do.