1. Security practices
Ango Voice uses layered safeguards designed for the sensitivity of voice, text, account, and subscription data. Current controls include:
- TLS-encrypted network connections for app, website, authentication, and API traffic.
- Firebase Authentication tokens for account-scoped requests and ownership checks.
- Firestore rules that restrict profile reads to the owner and keep entitlement, legal-acceptance, and usage writes server-controlled.
- Server-side secrets and payment processing that keeps full payment-card numbers out of Ango Voice systems.
- Short-lived or single-use credentials for sensitive flows such as desktop Apple sign-in and hosted subscription management.
- Data minimization, bounded usage-event history, and transient Mac audio handling for active requests.
- Signed Mac releases and an update mechanism designed to validate distributed software.
We review controls as the product evolves. No list of controls is a guarantee that incidents are impossible.
2. Reporting a vulnerability
Email admin@angomedia.com with:
- A description of the issue and its potential impact.
- The affected app version, URL, endpoint, or component.
- Clear reproduction steps and a minimal proof of concept.
- Any conditions needed to reproduce the issue.
- Your preferred contact information and whether you want public credit.
Do not include real credentials, personal information, raw voice content, or other users’ data in a report. Redact sensitive evidence or ask us for a secure transfer method.
3. Good-faith research guidelines
We will not pursue legal action against good-faith research that follows this policy, avoids privacy violations and service disruption, and gives us a reasonable opportunity to investigate before disclosure. This statement does not authorize conduct that violates applicable law or third-party rights.
- Use accounts and data you own or have explicit permission to test.
- Stop immediately if you encounter another person’s data and report the exposure without retaining it.
- Do not use denial-of-service, spam, social engineering, credential stuffing, physical attacks, or destructive techniques.
- Do not degrade availability, alter production data, install persistence, or move laterally into third-party systems.
- Allow time for remediation before public disclosure and coordinate disclosure timing with us.
4. Scope and exclusions
Reports about Ango Voice apps, angovoice.com, and Ango-operated backend endpoints are welcome. Third-party services—including Apple, Google, RevenueCat, Stripe, ElevenLabs, OpenAI, and Cerebras—must be reported through those providers’ own programs unless the issue is caused by our configuration or integration.
The following generally do not qualify by themselves: missing security headers without demonstrated impact, self-XSS, clickjacking on pages without sensitive actions, rate-limit observations without a practical security impact, public information, outdated-browser issues, and automated scanner output without validation.
AngoMedia does not currently promise monetary rewards or operate a bug-bounty program.
5. What to expect
We aim to acknowledge credible reports within five business days, assess severity and reproducibility, keep the reporter informed when practical, and remediate based on risk. Complex issues or dependencies may require more time. We may ask follow-up questions or request validation of a fix.
6. Protecting your account
- Use a unique password or a protected Apple/Google account.
- Keep macOS, iOS, browsers, and Ango Voice updated.
- Do not share sign-in links, verification codes, or subscription-management links.
- Review text before sending and avoid dictating secrets you are not authorized to process.
- Contact us promptly if you suspect unauthorized account activity.
7. Limitations and updates
Security controls reduce risk but cannot eliminate it. This page describes our current approach and is not a warranty, certification, or promise that every control applies identically to every provider. We may update this policy as architecture and reporting practices change.