Security

How we protect your account

• Encrypted connections. Palster is served only over HTTPS.
• Passwords we can’t read. Passwords are stored as Argon2id hashes, a slow one-way scramble designed to resist cracking. We check new passwords against known breaches without ever sending the password anywhere.
• Passkeys. You can sign in with your device’s fingerprint, face or PIN instead of a password. Passkeys can’t be phished, and your biometrics never leave your device.
• Two-step sign-in. Turn it on in Settings → Sign-in & security, and signing in with your password or Google also needs a 6-digit code from an authenticator app, or one of your recovery codes. We email you whenever it changes.
• Sign-in limits. Repeated wrong passwords slow down and then pause sign-in attempts, and sign-up needs a code sent to your email.
• Sign out everywhere. Resetting or changing your password signs out every device, and we email you when your password changes.
• Calls. Voice and video calls are encrypted between devices. Palsenger messages are encrypted in transit but are not end-to-end encrypted; see our Privacy Policy.

Keeping your account safe

• Add a passkey, or use a long password you don’t use anywhere else, and turn on two-step sign-in. A password manager helps.
• Keep your recovery codes somewhere safe and offline. They’re how you get back in if you lose your phone.
• Palster will never ask for your password or a sign-in code in a message, a post or a phone call. Only type them on palster.com.
• Be wary of links promising free Palneum, Plus or prizes, and of anyone asking you to pay or move a conversation off Palster before you’ve met.
• If you think someone else has got in, reset your password straight away from Forgot password (it signs out every device), then tell us.

Reporting a vulnerability

Email [email protected] or use the contact form. Please include what you found, where, the steps to reproduce it, and what someone could do with it. We’ll acknowledge your report within three business days, keep you updated, and tell you when it’s fixed. With your permission, we’ll thank you publicly.

Please

• Use only your own accounts, or test accounts you made, and stop as soon as you’ve shown the problem.
• Don’t access, change or keep other members’ information. If you come across any by accident, stop, delete it and tell us.
• Don’t disrupt Palster: no denial-of-service tests, spam, or automated scanning that slows the service for others.
• No social engineering of members or staff, and no physical attacks.
• Give us reasonable time to fix the problem before telling anyone else.

Our promise to you

If you follow these guidelines and act in good faith, we will consider your research authorised, won’t take legal action against you, and won’t ask anyone else to. We don’t currently offer payment for reports.

In scope

palster.com and its subdomains, including turn.palster.com (our call relay). Problems in other companies’ services should go to them.

Our security.txt file has these details in a machine-readable form.