Reporting a security problem

Where to send it

Email privacy@taletykes.com. This covers our website, our apps, and the addresses they talk to.

What to include

• What the problem is and what it would let somebody do.
• The steps to reproduce it, with the addresses and the device or browser you used.
• How to reach you, if it is not the address you wrote from.

What we ask of you

• Leave out any other family’s information, even if you could see it. Tell us that you could, and how.
• Use your own account. Do not open, change or delete anything that belongs to somebody else beyond what you need to show the problem exists.
• Do not test in ways that slow the service down for families, and do not send messages to our staff or to families pretending to be somebody else.
• Give us a chance to fix it before you tell anybody else about it.

What we do

• We write back within three working days to say we have it and are looking.
• We may write with questions while we look into it.
• We will not pursue anyone who reports a problem to us in good faith.
• If a report shows that somebody reached information they should not have, we tell the families affected, in plain words.

We do not run a paid bug bounty. What we do to keep families’ information safe is set out in how we look after this.