UMI

Security

Children's data deserves more care than most. Here is how we protect it, and how to tell us if you find a weakness.

How we protect data

  • Less to protect. We keep a first name and an age for a child, and no photos, birthdays or voice recordings (except, for 60 days, the voice clips of a test family that switched it on). What is not kept cannot leak.
  • Encrypted in transit. Everything between your browser and Umiko travels over HTTPS.
  • A locked database. Every table is closed to the public internet. Only Umiko's own server can read or write it, and we have a test that proves it.
  • No passwords for parents or children. Parents sign in with a one-time code or their Google account. Codes last ten minutes, allow five tries, and are stored only in scrambled form.
  • Signed sign-in cookies. They cannot be forged, and page scripts cannot read them.
  • Every door checked twice. A page checks who you are, and so does every action on it. A child cannot open a lesson, a family or an answer that is not theirs by changing an address.
  • Private details blocked. Phone numbers, emails and addresses are stopped before a child's words go anywhere.
  • Secrets stay on the server. No keys are placed in the app that runs on your phone.

If something goes wrong

If a problem ever affects your family's data, we will tell you what happened, what was involved and what we are doing, and we will inform the authorities as the law requires.

Report a security problem

If you have found a weakness in Umiko, please tell us before telling anyone else, so we can fix it and keep children safe.

  • Describe what you found and how to see it. Screenshots help.
  • Please do not open, copy or change anyone else's data, and do not disturb the service for others.
  • Test only with accounts you made yourself. The demo on the home page is a safe place to look.
  • We will reply, keep you informed, and thank you. We will not take legal action against someone who reports in good faith and follows these points.

Keeping your own account safe

  • Never share a sign-in code. Umiko will never ask you for one by message or call.
  • Sign a phone out from your family page if it is lost or given away.
  • Umiko never asks for an OTP, a PIN, a password or bank details. Anyone who does, using our name, is not us.

What we keep and why is in the Privacy Policy.