Security

How we protect your data

Timora stores only what is needed for schedules, grades and reminders. Personal data and passwords are encrypted before they are written to the database, every connection is secure, and you can delete your account yourself at any time.

Storage

What we store and how

Personal data is encrypted

Names, email, university portal login and Telegram and VK usernames are stored in the database encrypted with AES-256-GCM.
The key is kept separately from the database: a copy of the database file reveals nothing on its own.
Searching encrypted fields uses fingerprints from which the original value cannot be recovered.

Portal password — only if you allow it

The password is saved only if you choose so when signing in, and only in encrypted form.
It is used to fetch your grades and order certificates on your behalf, and for nothing else.
You can delete the saved password in settings with one tap.

Backups are encrypted

The database is backed up once a day and immediately encrypted with a public key. The private key is not stored on the server — the server cannot read even its own backups.
A second encrypted copy is kept on another server. Copies older than 30 days are deleted.

Profile photos without metadata

An uploaded photo is re-encoded from scratch: the location tag, the phone model and anything else hidden in the file are removed.
Only JPEG, PNG and WebP of reasonable size are accepted.

Transfer and access

Connections and servers

Secure connections only

The apps, mini apps and website work over HTTPS only, and browsers are not allowed to open the site without encryption (HSTS).
The servers also talk to each other over TLS.
A strict content security policy (CSP): the mini app does not load third-party scripts.

Locked-down servers

The database is not reachable from the internet.
Server access uses cryptographic keys only; passwords are disabled. Brute-force attempts are blocked automatically.
Security updates are installed regularly, and actions on the servers are recorded by system auditing.
The main server is in the Netherlands; the mirror of the website and the VK mini app is in Novosibirsk.

Sign-in and sessions

In Telegram and VK we verify the messenger's digital signature, so nobody can sign in as someone else.
Each device gets its own time-limited token that can be revoked separately — for example, when you sign out.
Request rates are limited to protect against password guessing, spam and bulk data scraping.

Logs without personal data

Passwords, tokens and personal data never end up in server logs.
Important actions — role changes, attendance marks, sign-ins and account deletions — go into a log that cannot be altered unnoticed: each entry is sealed with the fingerprint of the previous one.

On your device

Apps and third-party projects

iPhone app

Since version 6.4 the profile and token are kept in the protected iOS storage (Keychain), and grades in files covered by the system's data protection.
Since version 6.5 the Timora screen is hidden in the app switcher so that others can't see your grades.

Third-party apps — only with your consent

With “Sign in with Timora”, another project receives only what you allowed, and read-only.
You can revoke access at any time under “Connected apps”.

Ads without tracking

Banners are not personalised: personal data is not used to choose ads and is not shared with advertisers.
There are no third-party advertising or tracking scripts. Website statistics are collected only if you allow them in the cookie settings.

Your control

What you can do

Delete your account

Profile → Settings → “Delete account”. Your data is destroyed, including from backups, within 30 days.

Don't store your portal password

Don't save the password when signing in, or delete it in settings — grades are then refreshed only when you enter the password.

Revoke access for third-party projects

Profile → Settings → “Connected apps”.

Manage cookies on the website

The “Cookie settings” link at the bottom of any page.

Found a vulnerability? Message @timora_support on Telegram or write to timora-supp@yandex.ru — describe what happens and how to reproduce it. We will look into it and reply. Please don't publish details until the vulnerability is fixed.