How Findy and this website are secured
The strongest security property of Findy is architectural: there is no account to compromise and no server holding your scan results. This page sets out what that means in practice, how the website is configured, and how to report an issue to us.
The app
Scanning happens on the device
Camera frames, Bluetooth listings, local-network results, location comparisons and magnetometer readings are all processed on your iPhone or iPad. None of it is transmitted to us.
There is no account
We operate no user accounts, so there are no credentials to steal, no password database, no session tokens and no account-takeover route. There is nothing to sign in to.
There is no scan server
We run no back end that receives scan data. Scan history and the network device inventory are stored locally on the device, protected by iOS app sandboxing and the device's own encryption.
Payments are handled by Apple
Subscriptions are purchased through your Apple ID. We never receive or store card numbers or any other payment details.
The app contains two third-party SDKs — Superwall, which presents the paywall and reports entitlement state, and Lottie, which renders animations and has no network role. There is no analytics, crash-reporting, attribution, session-replay or advertising SDK. The full breakdown is on the privacy overview.
Findy cannot secure a device that is already compromised, and it cannot protect scan history from someone who has your unlocked phone. Set a device passcode and keep iOS updated — those two steps do more for the security of your scan history than anything the app can do on its own.
This website
findy.flapsapps.net is a static site. There is no server-side database, no application server, no user input processed on the server and no login. Pages are served as files.
| Control | Configuration | What it does |
|---|---|---|
| HTTPS | Enforced site-wide | Encrypts the connection between your browser and the site. |
| HSTS | Strict-Transport-Security |
Tells your browser to refuse a plain-HTTP connection to this site in future, closing the downgrade window. |
| Content-Security-Policy | Strict; no third-party script sources permitted | The browser will not execute script loaded from another origin, so no third-party tracker or injected script can run on these pages. |
| X-Content-Type-Options | nosniff |
Stops the browser guessing a file's type and executing something that was not meant to be executed. |
| Referrer-Policy | Restrictive | Limits what of your current URL is passed on when you follow a link away from the site. |
| Permissions-Policy | Camera, microphone and geolocation disabled | The website itself is barred by the browser from requesting your camera, microphone or location. Those permissions belong to the app, not to these pages. |
| X-Frame-Options | DENY |
Prevents the site being embedded in a frame on another page, which blocks clickjacking overlays. |
| Hosting | Static files on Cloudflare | No server-side database and no application code to exploit at request time. |
The site sets no cookies and runs no analytics. There is nothing on these pages that identifies you or follows you between visits.
Reporting a security issue
If you have found a vulnerability in the app or the website, please tell us directly rather than publishing it first. Email azattgoktas@gmail.com with "security" in the subject line.
What to include
- A clear description of the issue and what an attacker could achieve with it.
- Steps to reproduce it, in enough detail that we can follow them.
- The app version and iOS version, or the page URL and browser, depending on where you found it.
- Any proof-of-concept code, screenshots or request captures you have.
- How you would like to be credited, if you would like to be.
What we will do
These are intentions, not service commitments — Findy is maintained by one person.
- Acknowledge your report by email.
- Investigate it and tell you what we found, including if we conclude it is not a vulnerability.
- Keep you informed while we work on a fix, and let you know when it has shipped.
- Not pursue legal action against good-faith researchers. If you report an issue to us responsibly, we will treat you as having helped.
Access, modify or delete data belonging to anyone else; degrade the service for other people; or use social engineering against us or anyone connected to the project. Test against your own device and your own installation.
Findy is run by one person, so a reply may take a few days rather than a few hours. Every report is read.
See what the app processes
Every permission Findy requests, what it is for, and where the data goes.
Last reviewed 2026-07-23 · Written and reviewed by the Findy developer.