Security and Copyright

If you discover a security issue in Tuesday, please contact us with a clear description, affected URL or account area, reproduction steps, and any screenshots or logs that help us investigate.

• Do not access, modify, delete, copy, or disclose another user's data.
• Do not interrupt the service, run destructive tests, send spam, or attempt social engineering.
• Do not publicly disclose a vulnerability before we have had a reasonable chance to investigate and fix it.
• Report suspected account compromise, exposed data, phishing, or abuse as soon as possible.

Tuesday uses Firebase Authentication, Firebase/Google Cloud infrastructure, access rules, and app-level controls to help protect accounts and workspace data. Users remain responsible for choosing secure passwords, protecting email accounts, managing board access, and controlling public form or shared item links.

• HTTPS/TLS encryption for data in transit.
• Encryption at rest through Google Cloud and Firebase infrastructure.
• Firebase Authentication for account access.
• Firestore and Storage security rules that restrict board data and uploaded files to authorized board members.
• Role-based board permissions for owners, editors, and viewers.
• Public form safeguards, including rate limiting, upload size limits, blocked risky file types, and rich text sanitization.
• Email unsubscribe controls and rate limits for invite, password reset, workflow, chat, and form notification flows.

If we confirm a security incident involving Tuesday data, we will investigate, take steps to contain and remediate the issue, and notify affected users or customers when required by applicable law.

Tuesday relies on Firebase and Google Cloud infrastructure for operational durability, logging, and service recovery. Some data may remain for a limited period in backups, diagnostic logs, security logs, billing records, or provider systems after it is deleted from the active app.

If you believe content stored or shared through Tuesday infringes your copyright or other rights, contact us with the relevant URL or file reference, a description of the work, your contact information, and a statement explaining why you believe the content is unauthorized.