ClickPlaySecurity policy
Version 2026-08 · ClickPlay by Lybotech Group Pty Ltd · clickplay.online
Architecture: your media never rests with us
ClickPlay is designed so the most sensitive data — your photos, videos and voice notes — never resides on ClickPlay infrastructure. Media stays on your device or travels directly from the contributor's browser to the event host's connected cloud drive. Our database stores only account, event, permission and media-reference records, and enforces this at the database rules level: fields carrying binary or base64 content are rejected outright.
Access control
Every request is authenticated with Firebase Authentication and authorised against event membership and role (host, co-host, contributor, viewer) both in our API and in Firestore security rules, which are covered by an automated test suite of allowed and denied cases. Invitation codes are stored only as SHA-256 hashes; public share links use unguessable, revocable 192-bit tokens.
Credentials and encryption
Traffic is HTTPS-only. Google Drive access uses the narrow drive.file scope, so ClickPlay can only ever see files it created. OAuth refresh credentials are envelope-encrypted with Google Cloud KMS before storage in a server-only collection that no client can read, and are never sent to browsers. Disconnecting storage revokes the grant and deletes the stored credential without touching your files.
Media safety
Upload size, duration and type limits are enforced before any transfer begins, and file types are re-verified from provider-detected content after transfer. Executable files are rejected. Private media is never cached by our service worker and is served with no-store cache headers.
Operations
We log security-relevant actions (deletion, export, storage connection changes) to a restricted audit log, monitor errors centrally, and can roll back deployments immediately. Users see stable error codes — never internal details.
Reporting a vulnerability
If you believe you've found a security issue, email support@clickplay.online with the details. We ask that you avoid accessing other users' data and give us reasonable time to remediate before public disclosure. We'll acknowledge reports promptly and keep you informed of progress.