Security & reporting

Reviewed October 6, 2026 • Version 2026-10-06.1

Use a strong unique password or a device passkey. Keep your phone, browser and recovery email secure. Never share private appointment links, passwords or calendar credentials. Artists should revoke calendar access and client links when no longer needed.

Report an issue

Report a security vulnerability or data exposure • Report abuse • Report copyright concerns

Include a minimal description, affected feature, device/browser and safe reproduction steps. Do not include passwords, access tokens, full private client links or copies of government IDs. If you encounter another person's records, stop accessing them and describe the issue without copying or distributing their information.

Responsible testing

Test only accounts and data you own or have explicit authorization to use. Do not disrupt the service, social-engineer users, access other accounts, exfiltrate data, upload malware or continue testing after confirming unintended access. This policy does not authorize intrusive testing, promise a bounty, provide blanket legal immunity or authorize testing third-party providers.

Incident handling

Suspected incidents should be reviewed, contained and documented. The operator must determine whether user or regulator notices are required and give any required notices within applicable deadlines. The platform does not promise round-the-clock monitoring, automatic breach detection or a fixed support response time. Do not use this support channel for a medical or safety emergency.