At CampCrew, safeguarding family memories, private campsite logs, and personal data is central to our engineering architecture. This document outlines the technical security controls, access models, and operational measures protecting your data across our mobile applications, web platforms, and cloud infrastructure.
1. Security Architecture Principles
🔒 Zero Password Exposure
We do not manage or store passwords. User authentication is delegated entirely to Google OAuth 2.0 and Firebase Auth tokens.
👥 Crew-Scoped Isolation
Database and object access controls enforce strict tenant boundaries so data is never readable outside authorized family groups.
🌐 Enforced TLS 1.3 Transport
All client-to-server and cloud-to-cloud traffic is encrypted with modern TLS 1.3/HTTPS and strict security headers.
💳 Zero Card Data On Servers
All financial and payment transactions are handled directly by PCI-DSS Level 1 certified gateways (Stripe & Google Play).
2. Authentication, Access Control & Registration Passes
CampCrew relies exclusively on Google Sign-In via Firebase Authentication:
- Cryptographic JWT Verification: Client apps obtain cryptographically signed Firebase ID tokens. Every backend API call (including our Cloudflare Worker upload broker and Stripe webhook dispatchers) strictly validates token signatures, expiration claims, and audience targets against Google public certs.
- Registration Gating & VIP Access Passes: When public registration is toggled off, Firestore security rules strictly forbid unauthorized user document provisioning unless an active, unexpired, and matching Registration Pass (
registration_passes/{code}) is cryptographically verified and atomically claimed. - Waitlist Schema Validation & Invite Protection: Pre-launch waitlist submissions (
waitlist_submissions) enforce strict input schema bounds (email length, format, status validation) directly at the database rule layer. Cohort inspection and export access is restricted to authenticated administrators, while camper account claiming is verified against authenticated Google tokens upon registration. - Document Identifier Standardization: User records in Cloud Firestore are indexed using strict
google-{uid}document paths to prevent identity collision and enforce ownership verification.
3. Granular Database Security (Cloud Firestore)
Cloud Firestore data access is governed by comprehensive, emulator-tested Security Rules that operate at the query level:
- Private Crew Boundaries: Documents under
groups/{groupId}/trips,groups/{groupId}/amenities, andgroups/{groupId}/crew_ideasare restricted such that only active, verified members of that specific crew can read or write data. - Home Address Privacy: The user's home base address is stored exclusively in their personal
users/{userId}document. Firestore rules prohibit other crew members or third parties from reading or indexing this field. - Role-Based Access Control (RBAC): High-impact operations (such as deleting a crew, changing crew invite codes, or transferring crew ownership) require verified Owner permissions checked atomically within the rule engine.
- Ownership Transfer Protection: Crew creator IDs cannot be directly rewritten by clients; ownership transfers must complete through two-sided cryptographic verification.
4. Media Storage & Object Protection (Cloudflare R2)
CampCrew stores campsite photos, banner images, and park maps in encrypted Cloudflare R2 object storage with multi-layered defenses:
- No Public Bucket Access: Media buckets are completely private and do not allow anonymous uploads or public browsing.
- Ephemeral Presigned Upload URLs: Image uploads are brokered by a serverless Cloudflare Worker that validates the user's Firebase token, verifies tier limits, and mints short-lived (e.g. 5-minute), single-use presigned S3 URLs.
- Client-Side Compression: Photos are optimized and compressed on the user's device prior to transmission, reducing data transfer footprint and stripping unnecessary metadata.
5. Payment & Billing Security
- PCI Compliance: CampCrew does not process or retain card numbers, security codes, or bank account credentials. All web subscriptions and merchandise checkouts are rendered in secure Stripe Elements / Checkout iframes.
- Google Play Billing: In-app digital storage upgrades on Android are handled natively through Google Play's secure sandbox.
- Cryptographic Webhook Signatures: All backend billing events (such as Stripe subscription updates and Printful order receipts) require HMAC SHA-256 signature verification with dedicated webhook secrets before executing database changes.
6. Data Minimization & Right to Erasure
- Instant Purge Execution: When a user deletes a photo, trip log, or forum topic, delete commands immediately propagate to local cache, Cloud Firestore, and Cloudflare R2.
- Orphan Pruning Pipeline: Automated administrative routines scan storage buckets to detect and remove orphaned files from terminated crews.
- Account Deletion: Users can initiate permanent profile deletion anytime from the mobile or web app settings.
7. Vulnerability Disclosure & Bug Reporting
We welcome security researchers and community members to report potential vulnerabilities. If you discover a security flaw, please contact our dedicated security team:
Security Contact: security@campcrew.camp
Please include a detailed description of the vulnerability, reproduction steps, and proof of concept. We commit to acknowledging reports within 48 hours and will not pursue legal action against researchers acting in good faith.