Security

Authentication

• Sign-in uses phone number verification with a one-time code, via Firebase Authentication
• FrenXa does not ask for or store a reusable account password
• Multi-factor options (SMS or authenticator) are available where enabled
• Optional device biometrics can lock the app locally
• Nobody from FrenXa will ever ask you for your one-time code

Data in transit

• All traffic between FrenXa clients and our backends uses HTTPS/TLS
• One-to-one chats are end-to-end encrypted between participants
• Voice and video calls run over a real-time communication stack (Agora) using encrypted transport

Data at rest

• Application data lives in Google Firebase and Google Cloud services
• Firestore and Cloud Storage apply Google-managed encryption at rest
• Uploaded media is stored in cloud object storage tied to the FrenXa projects
• Mobile clients cache content locally for offline reliability; clearing app data or signing out removes those local caches

Application and API protection

• Firestore and Storage security rules gate every read and write by authenticated identity
• Privileged operations run server-side in Cloud Functions rather than on the client
• Firebase App Check helps reject requests that do not come from a genuine FrenXa app instance
• Rate limits and abuse controls protect sensitive endpoints
• Environments are separated — development and staging backends never share data with production

Payments

• In-app purchases and subscriptions are billed by Apple or Google
• FrenXa never receives or stores full payment card numbers
• Purchase receipts are validated server-side before entitlements are granted

Content moderation and abuse prevention

• User reports feed a moderation queue with human follow-up as capacity allows
• Automated text moderation signals are used where enabled
• Blocking limits contact and visibility between accounts
• Enforcement can include content removal, feature limits, suspension or termination

What you can do

• Keep your device OS and the FrenXa app up to date
• Protect access to the phone number tied to your account
• Turn on biometrics or a device passcode
• Never share one-time codes with anyone
• Report suspicious accounts and messages instead of engaging with them

Reporting a vulnerability

If you believe you have found a security issue, email support@frenxa.com with the subject “Security report”. Please include enough detail to reproduce the issue, and give us reasonable time to investigate before disclosing publicly. Do not access, modify or delete other people’s data while testing.