Security

• All traffic is encrypted over HTTPS
• Sign-in is handled by Google, so WatchTock never sees or stores a password
• Your sign-in cookie cannot be read by scripts on the page
• Each person’s saved data can only be reached by that person, enforced on our servers
• Administrator access is checked on the server for every request
• Text from sellers is displayed as plain text, so a listing cannot run code in your browser
• Links to sellers are checked against each seller’s known website
• Secret keys are held in a dedicated secrets service and are never sent to your browser

We take no payments and hold no card or banking details.

Your WatchTock account is only as secure as your Google account. We recommend turning on Google’s 2-Step Verification. WatchTock will never ask for your password.

If you believe you have found a vulnerability, please tell us using the details on our Contact page, and give us reasonable time to fix it before making it public. Please do not access anyone else’s data, disrupt the service, or run automated attacks while testing.

No online service can be guaranteed to be completely secure. If an incident affects your personal information, we will tell you as the law requires.