Security
Six things Horizon does with the data you trust it with, in plain words. The engineering behind each one is in the repository, and nothing here promises more than the code does.
Last updated 22 September 2026No password to lose
Horizon never sees or stores a password. Signing in goes through Google, which hands the server a signed statement of who you are — checked against Google's own published keys, and checked that it was issued to Horizon and not to some other app. Nothing else about your Google account is requested or reachable.
Sessions that can be taken away
Staying signed in uses a random 256-bit token in a cookie your browser will not hand to another website and JavaScript cannot read. The server keeps only a fingerprint of it, so the database could not be used to impersonate you, and signing out destroys the session immediately rather than merely forgetting it.
Only ever your own data
Every read, write and search is tied to the account that made the request, and ownership is never taken from anything a browser sends. Two people using the same names for their tracks cannot see each other's, and the database indexes are built so that a search can only ever run within one account.
Encrypted in transit, and kept in the EU
Every connection is HTTPS, and the server reaches the database over an encrypted connection with credentials that can touch that one database and nothing else. Both the server and the database run in Frankfurt, so your data stays in the European Union.
Backups nobody else can open
The database is backed up every week, encrypted with a key whose private half never leaves the author's own machine. The copy that gets stored is unreadable to anyone else — including the company hosting it — and the restore has been tested, because a backup nobody has restored is only a hope.
Deleting means deleting
Settings → Account → Delete account removes the account and everything it holds on the server in a single operation that either finishes completely or changes nothing at all. Your device keeps its own copy and the app carries on working offline.
You can use it with no account at all
None of the above applies if you never sign in, because nothing leaves your device: Horizon keeps everything in your browser's own storage, and there is no copy anywhere else to protect. An account exists only so your tracks can follow you between devices, and you can add or remove one whenever you like without losing anything.
What is checked, every time the code changes
Every change runs the same checks before it can reach the live site: the full test suite, including tests against a real three-server database; a scan for known vulnerabilities in every dependency, with each package verified as genuinely published by its author; a search through the entire project history for anything resembling a leaked password or key; and an automated review of the code itself for common security mistakes.
The live site is also watched. A check every half hour confirms the server can still reach the database, and the server counts anything it refuses — a sign-in that doesn't verify, a client asking too often — so that an unusual pattern is noticed the next morning rather than never. Those counts record what happened and never who it happened to.
What Horizon does not do
There is no analytics, no advertising, no tracking and no profiling. Nothing about your goals is sold, shared or looked at. The only companies involved are the ones that make the app run: Google for sign-in, Vercel for hosting, MongoDB Atlas for the database.
Being honest about the limits
Horizon is one person's project, not an audited product. It has a written threat model and a list of the risks knowingly accepted rather than fixed, and the people who accepted them are the same person writing this. If your data is sensitive enough that this matters, use Horizon without an account — then it never leaves your device, and none of these questions arise.
Found a problem?
Please report it privately to alessandroperez.developer@gmail.com rather than posting it publicly: what you found, how to reproduce it, and what it would let someone do. Reports are acknowledged within a week, and genuine findings get fixed before anything else.
What Horizon stores, where it lives and how long it is kept is on the privacy page.