Security
We don't gamble with your data and accounts
We store your texts, your brand and access to your social accounts. Here is how we keep them safe.
Customer data is isolated
Every workspace and brand is separated at the database level (Supabase Row Level Security); you only see workspaces you belong to. App requests run with your own session, so access is checked again in the database. Roles: owner, editor, viewer (read-only).
Social access tokens are encrypted
Instagram and Threads tokens live in Supabase Vault and are decrypted only by our server at the moment of a request to the network. Disconnect an account and the token is deleted. We never see or ask for your social passwords.
Payments run through Paddle
Paddle is our Merchant of Record. We don't store your card details.
Sign-in protection
Email confirmation, Google sign-in, password recovery. Login, sign-up and AI requests are rate-limited.
Input validation
Every API request is validated for type and size; unexpected fields are dropped. Uploads are images and videos only, size-limited, in private storage with short-lived links to your own brand's files.
Security headers
Content-Security-Policy, X-Frame-Options, HSTS in production; camera, microphone and geolocation disabled.
AI and your content
Posts are generated by Claude from Anthropic. The AI receives your brand card and the task for the current post, never other customers' data. Under Anthropic's Commercial Terms (version of 17 Jun 2025, checked 26 Oct 2026), Anthropic does not train models on customer content submitted through its services. Nothing is published without your approval by default.
Your data is yours
Export your texts and delete your account in Settings. Deletion removes your sign-in, profile, workspace (if you're the sole owner), brands, texts, files and tokens. Only anonymised hashes remain, to prevent repeat trials.
Services that process data
Supabase (database), Vercel (hosting), Anthropic (generation), Paddle (payments), Cloudflare R2 (files), Resend (service emails), plus the networks you choose to publish to.
Found a vulnerability?
Email hello@lurr.app. Please don't disclose details until it's fixed.
What we don't claim
We don't have SOC 2 or ISO 27001 certification yet.
Documents: terms of use and privacy policy.