Security

Every Leo Apps Studio LLC product — Road Travel, Leolens, Find It and this website — is built and run by the same small team, on the same security practices. Here’s what that means in practice.

Infrastructure

• Our services run on Google Cloud (Cloud Run) and Supabase, which maintain independently audited security programs.
• Web services run as non-root containers and scale per request; production projects are separated by product.
• API keys and other secrets live in a managed secret store (Google Secret Manager), never in source code or in the apps you download.
• Service accounts get only the permissions they need.

Data protection

• Encryption in transit: every connection uses HTTPS/TLS, and our websites send HSTS so browsers insist on it.
• Encryption at rest: databases, backups and file storage are encrypted by our providers.
• Access control: database row-level security means each account can reach only its own records; public database roles have no direct table access.
• Minimal collection: we don’t store card numbers (Stripe and Apple handle payments), analytics never include your places or identity, and our emails contain no tracking pixels.
• Backups: regular, encrypted database backups.

Accounts & sign-in

• Passwordless sign-in: email links, Sign in with Apple, Google, or passkeys — so there are no passwords of ours to leak.
• Sign-in tokens are signed, short-lived and verified on the server for every request, with the signing algorithm pinned.
• Road Travel on iOS can lock with Face ID; this happens entirely on your device.
• Internal admin tools are restricted to an allowlist of staff accounts.

Application security

• Strict security headers, including Content Security Policy and clickjacking protection.
• Request limits on public APIs to prevent abuse.
• Logs are scrubbed of credentials and tokens.
• Changes go through automated checks before they’re deployed.

Incident response

If we learn of a security incident affecting your personal information, we’ll investigate immediately, contain it, and notify affected users and authorities as the law requires — without unnecessary delay.

Reporting a vulnerability

We welcome reports from security researchers. Email leo.apps.studio@gmail.com with the subject “Security report”, and include the affected product and URL, steps to reproduce, and the impact you observed. We’ll acknowledge your report within 3 business days and keep you updated until it’s resolved.

If you act in good faith under this policy, we won’t pursue legal action against you. Please:

• test only against your own accounts and data, and stop as soon as you’ve confirmed an issue;
• don’t access, change or delete other people’s data, and don’t degrade our services (no denial-of-service, spam or social engineering);
• give us reasonable time to fix the issue before sharing it publicly.

In scope: roadtravel.info and its subdomains, tryleolens.com and its subdomains, this website, and our iOS apps. We don’t run a paid bug bounty yet, but we’re glad to credit researchers who help us. Machine-readable contact details are in/.well-known/security.txt.