Security at sk5s

We design our systems to minimize the data we collect and limit the impact of security incidents. We continuously review our infrastructure and openly communicate material security issues when they occur.

Contact us

For security questions or reports, contact us at security [at] sk5s.com.

What we collect and what we don't

Our products are built with a focus on privacy by design. Most sk5s apps do not require accounts and do not collect personal data beyond what is needed to provide the service.

• We do not sell user data.
• We do not collect data we do not need.

For app-specific details, see the data sensitivity section below.

Data sensitivity by product

Different sk5s products handle different types of data. We group them by sensitivity to help you understand what each app stores.

🟢 Low sensitivity

Countdate, party games, simple utilities, and AnswersAI

• No account required for basic use.
• No sensitive user data stored locally by default.
• Data is typically kept locally on the device.
• Some apps may optionally collect limited data such as an email address, or support signing in with sk5s ID for sync or backup features.
• Some of these apps include advertising provided by third-party SDKs, which operate under their own privacy policies.

🟡 Medium sensitivity

Weread

• May involve user-created content such as saved articles.
• Data handling depends on the specific product.

🔴 High sensitivity

allocrafter, CareTogether, and care-related products

• May involve financial, health, or caregiving-related information.
• We recognize these categories require higher protection and apply stricter access controls where applicable.

Third-party services

We use third-party services to host, deploy, and operate our products. For a list of subprocessors and compliance documents, see trust.sk5s.com.

Security incidents

We publish security notices and incident updates on our dedicated security messages channel:

• sk5s Security Notices (English)
• sk5s Security Notices (中文)

Vulnerability Disclosure Policy

We welcome reports from security researchers. If you believe you have found a security vulnerability in a sk5s product or service, please report it to us.

How to report

Send an email to security [at] sk5s.com with a clear description of the issue, including steps to reproduce, affected URLs or products, and any potential impact.

Scope

Reports should target sk5s-owned products, services, and websites, including:

• sk5s.com and subdomains
• sk5s mobile and web applications
• Open-source repositories under the sk5s organization

Out of scope

• Third-party services not owned or operated by sk5s.
• Reports requiring extensive user interaction or social engineering.
• Denial-of-service attacks or brute-force attempts.
• Issues related to unsupported or outdated software versions.

Guidelines

• Do not access, modify, or delete data that does not belong to you.
• Do not disrupt sk5s services or other users.
• Give us reasonable time to investigate and fix the issue before disclosing it publicly.

Response time

We aim to acknowledge reports as soon as possible. We will keep you informed as we investigate and resolve valid issues.

Recognition

With your permission, we will publicly acknowledge researchers who report valid security issues. If you prefer to remain anonymous, please let us know.