Data Safety & Security
Messliner uses TLS 1.3 encryption for data in transit and AES-256 for cloud storage in Google Firebase. Push notification tokens (OneSignal) are handled anonymously without exposing financial or personal details. We never sell or share user data with third-party advertisers.
1. Data Encryption Standards
Messliner implements strict security protections across transport and database storage layers:
- Encryption in Transit — all traffic between browsers, the Flutter mobile app, and backend servers is encrypted using bank-grade TLS 1.3 / SSL 256-bit protocols.
- Encryption at Rest — user databases, meal logs, and uploaded purchase receipts stored in Google Firebase Cloud use hardware-level AES-256 encryption.
- Secure Authentication — user sessions are protected using cryptographic JSON Web Tokens (JWT) to prevent unauthorized access.
2. Data Collection & Safety Breakdown
Below is a clean overview of how Messliner handles each data type (in full compliance with Google Play Data Safety standards):
- Personal Information — Name, Email Address, and Phone Number collected for account registration and manager invites. Encrypted in transit. Never shared with advertisers. Deletion available on request.
- Mess Ledger Data — Daily meal counts, bazar expense logs, and deposit records processed to compute the meal rate (Bazar Ratio). Encrypted in transit and at rest. Strictly visible only to members of your specific mess group.
- Push Notification Tokens — OneSignal Player ID and Firebase Cloud Messaging tokens collected solely to route meal cut-off alerts and deposit receipt notifications. Opt-out available anytime via app or Android device settings.
- Receipt Photos — Optional physical purchase receipt images uploaded by managers for expense proof. Encrypted in cloud storage.
- App Telemetry — Device model and OS version collected to diagnose crash reports and optimize Flutter WebView performance.
3. Push Notification Safety & OneSignal Integration
The Messliner Android Mobile Application uses the OneSignal Push Notification SDK to send real-time notifications.
Push notifications use anonymous device tokens. Personal passwords, financial transaction details, and private mess records are NEVER transmitted in raw push notification payloads. Notifications are limited strictly to functional mess alerts (e.g., meal lock deadlines, deposit updates, and end-of-month summaries).
4. Role-Based Access Control & Data Isolation
Messliner isolates data logically by mess group. Members of one mess cannot access meal or expense ledgers belonging to another mess group.
- Manager Administrative Privileges — only designated Mess Managers can input bazar costs, adjust meal prices, or log deposit receipts.
- Member View Security — general members enjoy view-only access to inspect all manager entries, ensuring total mess auditability without risk of unauthorized edits.
5. Cloud Infrastructure & Backups
Messliner is hosted on Google Cloud Firebase enterprise infrastructure with continuous automated backups across redundant cloud data centers, ensuring 99.9% service availability and data protection against hardware failures.
6. User Control, Export & Account Deletion
Users maintain full ownership of their mess records:
- Report Export — Mess Managers can download monthly ledgers and meal breakdowns as PDF or Excel files anytime.
- Permanent Data Removal — Users can request complete account and data removal by emailing messliner.app@gmail.com. Data is permanently purged from Firebase and OneSignal servers within 7 business days.
7. Security Vulnerability Reporting
We welcome security researchers and users to report any potential security concerns. Security vulnerability reports are acknowledged within 24 hours. Contact our security team at:
Security Email: messliner.app@gmail.com
Web Portal: https://messliner.netlify.app