Security at Glammy

• HTTPS in production and transport-security headers where deployment supports them.
• A restrictive content security policy, frame protection, content-type protection, referrer limits and permissions policy.
• Server-side input validation, request-size limits, same-origin checks and spam-resistance measures for forms.
• Restricted administrative access to deployment and email-delivery systems.
• Privacy-conscious logging that avoids intentionally recording form message bodies, passwords or access tokens.
• Dependency review, secure configuration and remediation of relevant reported vulnerabilities.

Infrastructure protections and production rate limits may be provided partly by the hosting platform. Final deployment settings must be verified before launch rather than assumed from source code alone.

Before salon accounts or connected-platform data are processed, Glammy intends to document and test authentication, role-based access, credential and secret handling, tenant separation, encryption, backup and recovery, auditability, secure development, incident response, vendor review, retention and deletion controls.

Any future Meta integration must use authorised connections, least-necessary permissions, protected tokens, customer-directed actions, controlled disconnection and applicable platform requirements. A roadmap entry is not evidence that these controls are live.

Access to production systems and submitted information should be limited to people who need it for an authorised role. Access should be reviewed, protected with strong authentication where available and removed promptly when no longer required. Confidentiality expectations and security responsibilities should be documented for people with access.

Glammy will assess credible security events, take steps to contain and remediate them, preserve appropriate records and notify affected parties or authorities when applicable law or contractual commitments require it. Public updates will be factual and will not disclose information that would create additional risk.

• Do not submit passwords, access tokens, payment-card credentials or unnecessary sensitive information through public forms.
• Use a current browser and protect the email account used for correspondence.
• Verify that messages requesting credentials or urgent payment genuinely come from an authorised Glammy channel.
• For future product accounts, use unique credentials, strong available authentication and prompt access removal for former team members.

Email contact@glammyapp.in with a concise description, affected URL or feature, steps to reproduce and potential impact. Do not access data that is not yours, disrupt service, use social engineering, publicly disclose an unresolved issue or include live secrets in the initial report.

Glammy does not currently publish a bug-bounty reward or safe-harbour programme. Good-faith reports will be reviewed, but no payment or response time is promised by this statement.

Glammy does not claim ISO certification, SOC reporting, penetration-test results, a service-level agreement, guaranteed availability or immunity from security incidents on this website. This statement will be updated only when an assurance can be supported by current evidence.