Security & Privacy at Davora

Your safety and privacy are our top priorities. Here's how we protect your data.

End-to-End Security

All data transmitted between your device and Davora's servers is encrypted using industry-standard TLS 1.3 encryption. This means your learning sessions, queries, and personal information are protected from interception.

Database Protection

Your data is stored in Supabase, a secure PostgreSQL database with enterprise-grade security. Passwords are hashed using industry-standard bcrypt algorithm. Row Level Security (RLS) policies ensure you can only access your own data—even our team cannot view your information without proper authorization.

Secure Authentication

Davora uses Supabase Auth with secure session tokens. Your passwords are never stored in plain text and are protected with modern hashing algorithms. You can enable additional security features and manage your login sessions from your account settings.

What We Store

What we keep:

  • • Your email address and hashed password
  • • Your learning sessions and chat history (for your reference)
  • • Your study progress and performance metrics
  • • Payment information (processed securely via Stripe)

What we DON'T do:

  • • We never sell your data to third parties
  • • We don't use your learning data to train AI models
  • • We don't share your information with advertisers
  • • We never access your data without your consent

Your Data Rights

You have complete control over your data. You can download, export, or delete all your information at any time from your account settings. If you delete your account, all associated data will be permanently removed from our servers within 30 days, except where we're legally required to retain it.

Compliance & Standards

Davora follows industry best practices and complies with:

  • • GDPR (General Data Protection Regulation)
  • • SOC 2 Type II standards
  • • OWASP security guidelines
  • • PCI DSS for payment security

API & Integration Security

All API calls are authenticated with secure tokens. Our infrastructure uses Vercel's globally distributed CDN with DDoS protection. We regularly audit our security posture and perform penetration testing to identify and fix vulnerabilities before they become problems.

Incident Response

In the unlikely event of a security incident, we have a dedicated incident response team ready to act immediately. We'll notify affected users as required by law and provide guidance on protecting your account. Security is an ongoing process, and we continuously monitor for threats.

Learning-Only Commitment

Davora is exclusively designed for educational and learning purposes. We will not assist with any non-educational activities. Your learning history is protected and never used for commercial purposes beyond improving Davora's educational features.

Questions About Security?

If you have any security concerns or questions about how we protect your data, please contact us at security@davoraai.com. We take all security reports seriously and respond promptly.