Updated October 8, 2026How we protect your designs
Your designs are your work. Here’s what keeps them private, how we check it, and what our latest review found.
What protects your data
Private by defaultDatabase rules let each account read and change only its own knives, feedback and notes. Nothing is public unless you share it yourself.
Sign in with a codeDuring testing you sign in with a one-time code sent to your email.
Keys stay on the serverThe database’s master key never reaches your browser. It lives only in our server settings.
Encrypted in transitEvery connection uses HTTPS, and browsers are told never to fall back to plain HTTP.
Locked-down pagesA strict content security policy lets the app run only our code and two pinned, integrity-checked libraries, and talk only to our own database.
Few outside servicesNo ad or analytics companies. Fonts are served from our own site. The full list is on the Privacy page.
Daily backupsThe database is backed up every day and backups are kept for 7 days, so a mistake doesn’t lose your knives.
Delete means delete“Delete my account and data” removes your account and everything saved with it from our servers.
How we check
- Every update: automatic checks for leaked secrets, for the page’s security settings, and that one account can’t read another’s data. These checks are being set up now.
- Every database change: a review of the access rules, then the database provider’s security advisor.
- Monthly: who has access to what, hardware security keys on every admin account, key rotation and software versions.
- Before launch and before paid features: a full review and hands-on testing, repeated as the product grows.
Latest independent review
October 8, 2026 · the app, its server code and the database rules
Reviewed by someone who didn’t write the code, by reading every part of it.
No critical or high-severity issues. Every finding is tracked until it’s closed. We describe a finding here only after it’s fixed.
Fixed the same day: sign-in now ignores links that try to switch accounts, and imported backup files are cleaned before they’re used. We also tightened which outside files the app can run and where it can connect.
Found a problem?
If you think you’ve found a security issue, email hello@knifeplan.com with “Security” in the subject. We’ll reply within two business days and won’t take action against good-faith research. Please don’t access other people’s data or disrupt the service.