Security

How we protect your account

• Passwordless sign-in with one-time codes that expire after 10 minutes and lock after repeated wrong attempts.
• Sessions are stored server side in HTTP-only cookies, so scripts on the page cannot read them.
• Sign-in requests and generations are rate limited to slow down abuse.

How we protect your data

• All traffic is encrypted with TLS.
• Uploaded files are checked by their contents, not their name, and only images are accepted.
• Reference images you upload can only be used in your own generations.
• Payments go through our payment processor. We never see or store card numbers.
• Payment webhooks are verified with a signature before any credits are granted, and each payment can only grant credits once.

Model providers

Prompts and reference images are sent to the model provider you choose, only to produce your output. We pick providers that do not train on customer data submitted through their API.

Reporting a vulnerability

If you find a security issue, email team@virality.cc with the details and steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and do not access other people's data while testing. We will reply within three working days.