How Tiptoe protects your data

Storage and encryption

Tiptoe stores account and couple data in AWS in us-east-2, Ohio. The configured data stores use encryption at rest. Connections to Tiptoe use HTTPS and encryption in transit.

Encryption reduces risk, but no online service can promise perfect security. Tiptoe does not claim end-to-end encryption.

Partner-private data partitioning

Shared records use the couple's shared data partition. Partner-private records use a user-specific partition, and private API routes are scoped to the signed-in user. A partner cannot ask a shared route to include the other person's private data. Gift ideas, private topic drafts, private votes, and check-in answers before reveal follow those access rules.

Accounts and service providers

The web app keeps session tokens in Secure, HttpOnly, SameSite=Lax cookies. AWS Cognito handles authentication. Stripe handles web payment details, and Apple handles iPhone purchase details. With the couple's consent, Anthropic Claude processes the information needed for Learnings and Voice note reports, and AWS Transcribe processes Voice note audio. Google Calendar access happens only for the connected feature described in the Privacy Policy.

Report a vulnerability

Email support@tiptoe.ai with the affected URL or feature, steps to reproduce, likely impact, and a safe proof of concept. Do not access another person's account, change or destroy data, degrade the service, or include sensitive user data in the report. We do not publish a bug-bounty promise on this page.