Security Standard

Estoka’s security approach rests on a few simple principles: your data is kept separate from every other user’s, all traffic travels over an encrypted connection, and we never store credentials for the third-party platforms you save links from.

Sign-in is handled entirely by Firebase Authentication using Google Sign-In. Estoka never sees or stores your Google password — authentication happens between you and Google, and Estoka receives only the account information described in the Privacy Policy.

Every user’s saved items, folders, and tags are stored in Cloud Firestore under a path scoped to that user’s unique user ID. Access is enforced by Firestore Security Rules, which block any user from reading or writing another user’s data.

This is enforced at the database level, not just inside the app’s interface.

All communication between the app, Firebase, and our backend running on Cloudflare Workers happens over HTTPS/TLS. Data is encrypted while in transit, so it cannot be read by a third party observing the connection.

Some backend operations need elevated access to Cloud Firestore — for example, fetching link preview metadata, cleaning up folder references, and generating data exports.

Every such request verifies the caller’s identity token before any action is performed. The credentials used for this elevated access are never exposed to the client app and are never committed to source code.

Estoka only ever reads public metadata from a shared link — the title, thumbnail, and creator that anyone would see.

It never logs in to, and never stores credentials for, Instagram, TikTok, Threads, Spotify, or YouTube on your behalf, and it does not access private or non-public content on those platforms.

Estoka collects only what it needs to operate the save, organize, and retrieve features. There are no advertising SDKs in the app, and we do not sell your data.

The full inventory of what we collect is documented in the Privacy Policy.

If you believe you have found a security issue in Estoka, please report it to us at [email protected].

We will acknowledge your report within 5-10 business days and work to resolve confirmed issues as quickly as possible. Please give us a reasonable opportunity to fix the issue before disclosing it publicly.