Responsible Disclosure Policy

MyRhythm holds personal information and creative work from young performers, so we treat security reports with the utmost seriousness. If you believe you have found a vulnerability, a weakness or a privacy issue in the platform, we want to hear from you.

We will acknowledge your report promptly, investigate it in good faith, and keep you informed of the outcome where it is appropriate to do so.

Send details of the issue to security@myrhythm.io. Include enough information for us to reproduce the problem — a description, the affected page or feature, and any steps, screenshots or proof-of-concept details you can safely share.

Please do not submit reports through public channels such as social media, app reviews or the general info inbox, as this can delay triage.

When investigating and reporting, please:

• Use only accounts and data you own or have explicit permission to use.
• Never access, download, copy, modify or delete data that belongs to other members — particularly children's information.
• Do not run denial-of-service, spam, or physical or social-engineering attacks.
• Give us a reasonable window to fix the issue before publishing any details publicly.
• Act in good faith and avoid privacy violations, degradation of service and disruption of other users.

MyRhythm does not operate a cash reward scheme. We do not offer payment, bounties or monetary compensation for vulnerability reports, and contacting us on the expectation of payment will not change that.

What we do promise: every validated issue is contacted so we can thank the person behind the contribution. Where it is possible for us to do so, we like to go a step further and send merchandise as a token of appreciation — but there is no guarantee that we can do this, and the absence of a thank-you gift is never a reflection on the value or quality of a report.

If you would like to be credited, let us know in your report. With your permission, we may list your name or handle in acknowledgements of contributors. You can also ask to remain anonymous — we will honour either choice.

We will never publish technical details of a live vulnerability before a fix has been deployed and affected members, where relevant, have been informed.

Validated reports are triaged, prioritised by risk — with issues affecting children's data or media access treated as the highest severity — and remediated. We aim to acknowledge reports within five working days and to give an initial assessment as soon as the investigation allows.

Where a report shows a real risk to members, we will inform affected users as required by our Incident Response & Data Breach Policy and applicable law.

If you make a good-faith effort to comply with this policy during your research and reporting, MyRhythm will consider your actions authorised, will not pursue legal action over the report itself, and will work with you to understand and resolve the issue quickly.

Activity that goes beyond this policy — accessing other people's data, disrupting the service, or exploiting an issue for gain — is not authorised and may be reported to the authorities under our Acceptable Use & Community Standards.

This policy covers the MyRhythm web application, its APIs, and the media delivery systems that serve performer content. Third-party services we depend on should be reported through the responsible-disclosure programme of the relevant provider, though we are happy to pass reports along.

The current version and effective date are shown at the top of this document. We give members at least 30 days' notice before a material change takes effect, and each version is listed in the version history below.