Our approach
We use technical safeguards and access controls to help protect personal information and operate our communities.
This overview complements our Privacy Policy and Terms of Service. It does not replace those documents or a separate written agreement.
Account privacy
Anonymous posting does not mean Fizz cannot identify your account. We use account identifiers to associate users with their content and activity.
We do not display your account email address or phone number alongside anonymous posts. Information you choose to include in posts, profiles, or messages may identify you. Recipients may also save or share content outside Fizz.
How we protect information
- Access controls: Authentication and permission checks help control access to account features and protected resources. Our internal administrative tools require authenticated staff accounts and use roles and permissions to restrict protected functions.
- Transport encryption: Our mobile apps connect to Fizz's API over HTTPS to protect communications in transit.
- Protected credentials: Our mobile apps use protected storage for authentication credentials. Our backend retrieves service credentials through a managed secrets service.
- Monitoring: Error reporting and performance monitoring help us investigate problems. Diagnostic controls redact selected sensitive fields, but do not make all diagnostic data anonymous.
Transport encryption is not the same as end-to-end encryption. Fizz processes content, including chat messages, to operate the service and support moderation, as described in our Privacy Policy.
No system can guarantee complete security or eliminate every risk of unauthorized access, disclosure, or use.
Never give anyone your one-time password (OTP) SMS verification code. Fizz will never ask you to share it.
Service providers
We use providers for hosting, storage, authentication, analytics, communications, purchase management, and moderation. Below are selected providers and links to the security practices for each.
- Google Cloud: Hosting, analytics infrastructure, and supporting cloud services.
- MongoDB Atlas: Storage of application records, including account information and content.
- Redis: Caching and supporting application data storage.
- Mixpanel: Product analytics.
- Amazon Web Services (AWS): Sending emails through Amazon Simple Email Service (SES), including account and verification messages.
- Telnyx: SMS verification messages and phone-number checks.
- Grafana: Operational metrics, logs, and performance traces.
Telnyx processes phone numbers, SMS verification message content, and phone-number lookup results. Email delivery involves recipient addresses and message content. Monitoring data may include account identifiers and diagnostic context.
These links describe each provider's security practices, not Fizz's configuration or security guarantees.
Depending on the feature, providers may process account identifiers, contact details, content, device and usage information, diagnostics, or subscription information. AI-assisted features, including moderation, translation, and content summaries, may involve providers processing user text, media, or chat context.
These are selected examples, not a complete provider list or contractual subprocessor register. Provider use can vary by feature, platform, and configuration.
Your information and choices
Our Privacy Policy explains information sharing, retention, deletion, and your privacy choices. Refer to that policy for the details and applicable exceptions.
Questions and vulnerability reports
For privacy or account questions, see our FAQ or email info@fizz.social.
To report a security vulnerability, follow our Vulnerability Disclosure Policy. It explains reporting requirements, research rules, and what to expect from us. Our security.txt also provides reporting details.