Security

Our Approach

Security is built into how AtListen is engineered, not bolted on afterward. This page describes, in plain language, the real technical measures Lyon Innovations, LLC ("AtListen," "we," "us") uses to protect your account, your study content, and your payment information. It's a public overview meant to be read alongside our Privacy Policy, not an exhaustive technical specification.

Account & Data Protection

Your account and study content are stored using Firebase Authentication and Cloud Firestore, and all of our backend logic runs on Cloud Functions. Every request to those functions must carry a valid authentication token issued to your signed-in session, which is verified before any request is processed — there's no route into your data that skips this check.

Sensitive fields on your account — including billing status, subscription and credit details, email-verification status, trusted-device records, and information related to parental consent for younger users — can only ever be written by our own server-side systems. Our database security rules explicitly block these specific fields from being modified directly by a signed-in client, so even a technically sophisticated user cannot grant themselves a paid plan, mark their own email as verified, or alter consent records from their browser's developer tools.

Payment Security

AtListen never sees or stores your card details. All payments and subscription management are handled through Stripe's hosted Checkout and Billing Portal — when you pay or manage billing, you're securely redirected to Stripe's own infrastructure, and your card number never passes through our servers or our client-side code. On our end, we only ever receive notifications of billing events from Stripe over cryptographically signed webhook messages, which we verify before acting on them, so billing changes to your account can't be spoofed by a forged request.

Email Verification & Device Trust

Every account — whether created with email and password or with Google sign-in — must confirm access from a new device using a one-time 6-digit code sent to the account's email address. Once verified, that device is trusted for 30 days; after that window, or on any unrecognized device, a fresh code is required. Verification codes are single-use, expire quickly, and attempts to guess them are rate-limited.

Protecting Younger Users

AtListen is built to comply with the Children's Online Privacy Protection Act (COPPA). Signups from users under 13 are automatically detected and placed on hold until a parent or guardian completes a verifiable consent process, and no account content is generated while that hold is in place. Parents can review, manage, or request deletion of their child's account and data at any time. See our Privacy Policy for Children Under the Age of 13 for full details.

Browser & Network Protections

Every page on AtListen.com is served with a strict set of browser security headers:

• A Content Security Policy that restricts which sources of scripts, styles, and other resources a page is allowed to load, reducing the risk of malicious script injection.
• A directive that stops browsers from misinterpreting the type of a file in ways that could be exploited to run unintended code.
• A strict referrer policy, which limits how much information about your browsing on AtListen is passed along to other sites when you click a link away from us.
• A permissions policy that disables access to sensitive browser features like the camera by default, and only allows microphone access for the specific features that genuinely need it, such as voice input.

The site is also served exclusively over HTTPS, so traffic between your browser and AtListen is encrypted in transit.

Data Minimization & Retention

We aim to keep only what we need. For example, when a child's account is deleted under our parental-consent process, we don't just deactivate it — we remove the underlying account and study data and collapse the remaining record to a minimal audit stub, rather than retaining information indefinitely "just in case." More generally, we retain personal information only as long as reasonably necessary for the purposes described in our Privacy Policy, after which it is deleted, destroyed, or de-identified.

Responsible Disclosure

If you believe you've found a security vulnerability affecting AtListen, we want to hear about it. Please email us at hello@atlisten.com with enough detail for us to investigate — steps to reproduce, the affected page or feature, and the potential impact — and give us a reasonable opportunity to look into and address the issue before disclosing it publicly. We don't currently operate a paid bug bounty program, but we take good-faith reports seriously and will respond.

No System Is Perfect

No method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security. We continue to invest in improving these protections as AtListen grows. This page reflects our practices as of the date above and may be updated as our systems evolve; it is not a warranty of security, and we do not currently hold third-party security certifications or audits (such as SOC 2 or ISO 27001) — if that changes, we'll update this page to reflect it.

Questions

For questions about this page or our security practices generally, contact us at hello@atlisten.com.