Security

Responsible disclosure

We take the security and privacy of our users seriously: Looqa handles photos of your clothes and other personal data. If you believe you have found a vulnerability, we want to hear from you.

How to report

Email security@looqa.ai. Please include: what you found, the steps to reproduce it, the impact, and any proof-of-concept. Do not include other people's personal data in your report.

Our commitment (safe harbour)

If you make a good-faith effort to comply with this policy during your research, we will not pursue or support legal action against you, and we will work with you to understand and fix the issue quickly. We aim to acknowledge your report within 3 business days and to keep you informed of our progress.

Scope

In scope: the Looqa web application (looqa.ai and its subdomains) and the Looqa mobile apps. Out of scope: denial-of-service (DoS) attacks, physical attacks, social engineering of our staff or users, spam, and automated scanning that degrades the service for others.

What we ask

Do not access, modify, or delete data that isn't yours. Use test accounts and stop at a proof-of-concept.
Report promptly and give us reasonable time to fix before disclosing publicly.
Do not run attacks that could harm users, their data, or the availability of the service.