Security

Guest financial plans and workspaces are stored in your browser. Signing in enables cloud sync, which stores an encrypted copy in our application database. Planning calculations also transmit scenario data over HTTPS; calculation requests are processed for that request only and are not written into operational logs.

Local storage reduces long-term server-side exposure, but it does not secure an unlocked device or shared browser profile. Browser storage is not encrypted by nomorework. Anyone with access to that profile may be able to read its contents.

After a successful sync, the guest plan copy is removed from this browser. Signing out returns you to guest mode without copying your cloud plans back to local storage or immediately saving an empty guest plan. Your cloud plans remain in your account. New guest edits are saved on this device. If migration fails, the existing guest data stays on the device so you can retry.

Signing out clears this tab’s migration-complete marker. Browser storage and the Planner license cookie are shared within a browser profile; signing out does not create an isolated profile or transfer a license to another account. Use separate browser profiles for different people.

If cloud sync cannot finish, an account-specific recovery draft may remain in IndexedDB in this browser profile. It is available only after the same account signs in, but anyone who controls the unlocked browser profile may still read local browser storage.

The application uses server routes for authentication, encrypted plan sync, plan calculations, market-quote requests, license verification, and billing webhooks. Calculation requests include the scenario data needed for the response. Quote requests include ticker symbols. Purchase requests include your account email and identifier. Normal site requests also create limited infrastructure and security metadata. Structured logs include request identifiers, operation names, status, duration, and provider event identifiers only. See the Privacy Policy for the full data-flow summary.

Current application controls include:

• schema and input validation at application boundaries;
• server-authoritative entitlement checks that fail closed;
• request size limits, calculation rate limits, and timeouts for market-quote lookups;
• production rejection of development-only license shortcuts and test-mode billing payloads;
• signed HTTPS billing-portal links that are not stored by the application;
• security headers covering framing, content types, referrers, permissions, and transport; and
• exact allowlisted origins for Lemon Squeezy checkout scripts and frames.

These controls reduce risk but are not a security certification, independent audit, or promise that every vulnerability will be prevented.

• Use a device account and browser profile that other people cannot access.
• Keep your operating system and browser updated.
• Use Start Fresh before leaving a shared device.
• Do not share access to your account.
• Clear browser storage before selling or transferring a device.

JSON, CSV, printed, and PDF exports can contain sensitive financial information. NOMOREWORK cannot control a file after it is downloaded. Store exports in a protected location, share them only with intended recipients, and remove copies you no longer need.

Send security reports to contact@nomorework.ca. Include the affected page or feature, steps to reproduce, observed impact, browser or device details, and any safe supporting material.

Do not include real financial plan data, payment credentials, another person's information, or a live license key. We do not promise a specific response or resolution time, but complete and reproducible reports are easier to assess.

Test only with data, devices, licenses, and accounts you are authorized to use. Do not access another person's information, disrupt availability, run denial-of-service tests, use social engineering, send malware, or retain data obtained accidentally. Stop testing and report the issue if you encounter information that is not yours.

No website, browser, device, network, or third-party service can be guaranteed completely secure. Security depends on NOMOREWORK, its providers, and the way each user protects their device, browser profile, license, and exported files.