Do not post vulnerabilities, player names, saved documents, score history, credentials, device identifiers or private screenshots in public issues.

GitHub private vulnerability reporting was enabled and verified on November 2, 2026 EST. Use Report a vulnerability for security vulnerabilities. This requires a GitHub account and sends the report privately to repository security maintainers. There is no bounty or promised response deadline. General private support without GitHub is not yet available; do not use public issues for sensitive reports.

Use the public issue templates for gameplay and usability problems or non-sensitive privacy questions. They require a GitHub account. Use fictional examples and review attachments.

The native diagnostics preview contains allowlisted app/OS/layout/schema information and sends nothing automatically. It is not a save export. The system share sheet sends the previewed text to the destination you choose, which may use its own network service.

The privacy policy describes the native development app and hosting. Signed-device privacy acceptance is still tracked in issue #48.