Security

Accounts and sign-in

Sign-in is handled by Firebase Authentication. Your password is checked by Google’s systems and never reaches ours; with Google sign-in no password reaches us at all. Sessions use signed tokens that expire after an hour and renew while you are active. Without “Keep me signed in”, the session ends when you close the browser, and you are signed out automatically after a period without activity.

Keys stay on the server

The keys for our AI provider, our database administration and our payment provider exist only on the server. They are never sent to your browser or written into the database. Every AI request goes through our own server, which checks the account, the allowance and the input before the provider is contacted.

Database and storage rules

Firestore and Cloud Storage enforce access rules that Google applies, not our application code. With them:

• a worksheet can be read and changed only by its owner — and read by the students the owner assigns it to, or by anyone once it is published;
• a worksheet’s owner cannot be changed by editing it;
• uploads are limited by file type and size, and are written only to a folder belonging to your account;
• plans, roles and student accounts can be changed only by our server, never by a browser.

Abuse prevention

• Bot check: requests for account features — saving, AI, classes, billing and your account — are refused without a valid Firebase App Check token, issued only after Google reCAPTCHA has checked the request comes from our real website. The few things that work without signing in (cookie choices, data requests, content reports, published worksheets) are protected by rate limits instead, and payment notifications are accepted only with the payment provider’s signature.
• Rate limits cap how fast any account or address can call costly or sensitive features.
• Monthly allowances bound AI generation; a generation that fails after it was counted is returned automatically.

Content safety

Text you or others enter is cleaned before it is shown, so a worksheet cannot carry code into someone else’s browser. AI output is checked against a strict format on the server before it reaches your page. Pictures imported from the web are fetched by our server over HTTPS only, with size limits, no redirects and internal network addresses blocked.

Transport and hosting

All traffic uses HTTPS. The site runs on Vercel; data is stored in Google Cloud through Firebase.

What we ask of you

• Use a strong, unique password, or sign in with Google.
• Keep students’ personal information out of worksheets and AI prompts — no technical control replaces this.
• Tick “Keep me signed in” only on your own device, and sign out on shared or classroom computers.
• Keep student login cards private.

Reporting a vulnerability

If you think you have found a security flaw, tell us at privacy@yourworksheets.com or through the help center with the category “Security report”. Our security.txt lists the same contact.

• Give us a reasonable time to fix the issue before you disclose it.
• Do not access, change or delete other people’s data; use your own test accounts.
• Do not run denial-of-service tests or social-engineering attempts.

We will not take legal action against research done in good faith within these limits. We aim to acknowledge reports within five working days. We do not offer payment for reports.

If something goes wrong

If a personal-data breach happens, we contain it, record it, and — where the law requires — notify Türkiye’s Personal Data Protection Board within 72 hours of becoming aware of it. If it puts you at risk, we tell you as soon as possible, in plain language, with what happened and what you can do. Teachers and schools are told without delay when student data is affected.

Honest limits

No online service is perfectly secure, and we will not pretend otherwise. What we can say is that the controls above are in place, that keys are kept off your device, and that we will tell you if a breach puts your data at risk.