Security

Sign-in without passwords

You sign in with a passkey or a one-time link sent to your email. Sign-in links work once and expire after 15 minutes. Invite links work once, only for the invited email, and expire after 7 days. There are no passwords to leak or reuse.

Infrastructure

Casa Cadence runs on Cloudflare: Workers for the app, D1 for the database, R2 for files and Cloudflare Email for sign-in and invitation emails. All traffic uses HTTPS.

Access is checked on the server

• Roles (owner, member, helper) are enforced on the server for every request. Helpers reach only the tasks assigned to them.
• Kids mode locks a device to the kids view. Leaving it takes a parent's passcode, with a lockout after repeated misses.
• Shared links use random tokens that we store only in hashed form. Every link expires within 90 days and can be turned off instantly. Shared pages never show notes, contacts, files, people or points, and are hidden from search engines.

Calendar credentials

Calendar connections are planned and are not available yet. The current app does not collect Google or Microsoft calendar tokens or iCloud app-specific passwords.

Reporting a problem

If you find a security issue, please email hello@casacadence.com with “Security” in the subject. We'll reply promptly and won't take action against good-faith research.