Security

• The service is served over HTTPS, with HTTP Strict Transport Security (HSTS) instructing browsers to use encrypted connections.
• Security headers are set on responses, including frame protections, content-type protections, a referrer policy, a permissions policy, cross-origin isolation headers, and a Content Security Policy operating in report-only mode while it is tuned.
• Input validation, file type and size checks, rate and cost controls, and bot protection guard the request paths.

Authentication uses Better Auth with signed session cookies, with separate guest and registered account flows. Server-side boundaries keep internal intelligence and licensed market data provider responses out of the customer-facing bundle; customers receive customer-safe Decision File projections.

Card details are entered into Stripe-hosted payment fields and are processed by Stripe; Ask Bobby J does not receive or store full card numbers. Purchases are confirmed server-side using Stripe webhook signature verification before any entitlement is granted.

• Photos and documents you upload are stored in private storage that is not publicly listable, under randomized object names scoped to your account.
• JPEG and PNG images are stripped of embedded metadata, including EXIF location data, as part of upload processing, so a photo taken on your phone does not carry its GPS coordinates into storage.
• Uploads are subject to type and size limits and to a retention process that removes files that are no longer needed.

• Independent penetration testing and third-party security audits as the service matures.
• Formalized least-privilege access reviews, secret rotation schedules, and production audit trails.
• Documented incident response, evidence preservation, vendor escalation, and multi-jurisdiction breach-notification routing.
• Promotion of the Content Security Policy from report-only to enforcing mode.

If you believe you have found a security vulnerability, report it to [security email] and include enough detail to reproduce the issue. Please do not access other customers’ data, degrade the service, or publicly disclose an issue before we have had a reasonable opportunity to address it. This page does not authorize testing of production systems or access to customer data; a formal safe-harbor and coordinated-disclosure policy is being finalized with counsel.

No online service can promise absolute security. Ask Bobby J will not claim absolute security, anonymity, zero retention, complete deletion, encryption everywhere, or any certification that has not been independently obtained and kept current.