Security

Privacy only means something if it's backed by real engineering. Here's how BTWEEN protects your circle.

Private by design

• Media is stored in private object storage and delivered only through short-lived, cryptographically signed links — never public URLs.
• Every drop is served per-viewer, with dynamic watermarking on sensitive media.

Accounts & sessions

• Phone sign-in with one-time codes; no reused passwords to leak.
• Rotating refresh tokens with reuse-detection that invalidates a session if a token is replayed.
• Push tokens are stored encrypted.

Data integrity

Uploads are checksum- and size-verified, and metadata is stripped before delivery. Every important action is transactional and idempotent, so a drop is never half-sent.

Safety tooling

Blocking, reporting, capture-event logging and moderation review are first-class — with no automatic punishment based on a single signal.

Report an issue

Found a vulnerability? Please reach us through the in-app Support screen so we can address it quickly.