How we protect your data
Updated September 18, 2026. This page describes the current implementation and its limits. It is not a security certification or a guarantee of emergency response.
Account access is designed around random tokens sent by email. The current implementation stores tokens with expiry dates and checks them before protected account requests. It does not use the password or JWT system previously described on this page. Treat these links as credentials: do not forward them, post them publicly or include them in screenshots.
The website is hosted on Cloudflare. The service implementation uses Workers and a D1 database; its email delivery code calls MailChannels. A hosting provider can process application data as well as network requests. Production deployment, access permissions, backups and delivery reliability require operational checks; a provider's feature list alone does not demonstrate that every feature is enabled here.
Use the HTTPS address for this site. We do not promise that every connection negotiates a specific TLS version or that every route has a particular HSTS lifetime. Browser security indicators concern the connection, not the reliability of check-in notifications.
Checkout is designed to use Dodo Payments rather than collect full card details on this site. Payment activation, webhook validation, cancellation and delivery still require separate end-to-end verification. Their presence in source code is not a completed security assessment.
Automated escalation, timezone scheduling and email delivery have not completed operational verification. Do not depend on this service to detect an accident, summon help, or prove someone's wellbeing. Arrange a direct check-in with a willing person and contact local emergency services when there is immediate danger.
For access or deletion requests, contact privacy [at] soimok [dot] com. For a suspected vulnerability, contact security [at] soimok [dot] com. Describe the affected page and a minimal reproduction without including private tokens, passwords, medical records or other people's data. No guaranteed response time or PGP key availability is promised here.
Do not access accounts you do not own, send mass requests, or modify production data to demonstrate an issue. See our Privacy Policy for data handling. We do not claim blanket GDPR/CCPA certification; legal duties and incident notifications depend on the applicable circumstances.