Security Policy

What this policy covers

This policy covers the website at thelittleworker.com, the web app at app.thelittleworker.com, the Little Worker app for Mac, and the Little Worker app for iPhone (together, the "Service"), provided by RAPTURE ENTERTAINERS, INC. ("Little Worker").

Workers do to-dos with AI providers and apps you choose, and with the Mac app, on your Mac. Little Worker secures the software and servers it operates. It does not control the security of your devices, networks, the account you sign in with, the apps you connect, or the AI providers you use. Read the shared responsibilities below when you decide what to allow.

Report a security problem

If you think you found a security problem in the Service, email security@thelittleworker.com. Do not share the problem publicly until Little Worker has had a reasonable time to look into it and fix it.

Include, when you can:

• what the problem is and what harm it could do;
• where it is: the website, the web app, the Mac app, or the iPhone app, with the version, page, or address;
• clear steps to reproduce it, or the smallest example that shows it;
• screenshots, logs, or requests and answers, with any keys and passwords removed;
• how to reach you, and whether you want public credit.

Little Worker aims to confirm it received a complete report within three business days, to tell you about significant progress, and to agree with you on when to disclose the problem after it is fixed. How long a fix takes depends on how serious and complex the problem is, and on other companies it depends on.

Good-faith research and safe harbor

Little Worker supports good-faith security research. If you make a real effort to follow this policy, avoid harm, respect privacy, and report what you find promptly, Little Worker treats your research as authorized and will not start legal action against you for accidental, good-faith breaches of this policy. If someone else starts legal action about research that follows this policy, Little Worker will make its authorization known where appropriate.

To stay within this safe harbor, you must:

• test only accounts, data, and systems that you own or have clear permission to test;
• stop and report at once if you reach personal, confidential, or real customer data;
• see only the least information needed to show the problem;
• not disrupt the Service, slow it down, or damage or delete data;
• not use social engineering, phishing, physical attacks, or denial-of-service testing;
• not test other companies' services or systems that Little Worker does not control, such as the AI providers and connected apps;
• give Little Worker reasonable time to fix the problem before you disclose it publicly.

This safe harbor does not authorize breaking the law or anything outside this policy. Rewards for reports are not promised. If Little Worker offers one, it decides the reward at its own discretion.

How Little Worker protects the Service

Little Worker uses administrative, technical, and organizational safeguards suited to the Service and the information it handles. They include:

• Least data needed. A worker sends an AI provider only the parts of your workspace that a to-do needs. Crash reports leave out the text you write.
• Encrypted connections. All traffic to the Service is encrypted with HTTPS. Backups of the servers where workers do to-dos are encrypted.
• Protected sign-in and keys. The Mac and iPhone apps keep your sign-in in the Keychain. Keys you add for AI providers, and the access Google gives when you connect a Google app, are kept apart from your other data.
• Limited access. Access to the Service's systems and data is limited to the people who need it, and is protected with sign-in and permission checks.
• Your Permissions. Workers act in the apps you connect and on your Mac only as your Permissions allow. Screen Control works only in a window you allow, and only from the signed Little Worker app.
• Monitoring and updates. Little Worker watches error reports and server records for problems and security events, reviews the software the Service depends on, and ships fixes as needed.
• Established companies. Little Worker uses specialized companies for sign-in, hosting, payments, and app distribution, listed in the Privacy Policy.

No system is completely secure. These safeguards lower the risk, but they do not promise that the Service is free of security problems or unauthorized access.

Your responsibilities

You control much of what workers can reach, so you have an important part in keeping it secure. You are responsible for:

• keeping the Little Worker apps, your operating system, and your browser up to date;
• securing your devices, networks, and backups;
• keeping the account you sign in with secure, and turning on two-step verification where Google, Apple, GitHub, or your email service offers it;
• protecting keys you add for AI providers, and replacing a key you think was exposed;
• giving workers and connected apps only the Permissions they need;
• checking what a worker will do, and its results, before you allow or use them;
• removing a Mac you no longer use, and disconnecting apps you no longer need;
• following the security rules of the apps and AI providers you connect.

Never put a password, an API key, or a private key in a report. If one may have been exposed, replace it before you send Little Worker what you found.

Changes to this policy

Little Worker can update this policy as the Service and its safeguards change. The new version is posted here with a new effective date. Significant changes to how reports work or to the safe harbor apply only from their effective date onward.

Contact

Report security problems or ask about security at security@thelittleworker.com.

For legal questions, email legal@thelittleworker.com. For privacy requests, email privacy@thelittleworker.com.