Safety
Security practices
How Olulyo protects access and separates family data. Effective 15 October 2026.
Design choices
- Per-family databases — each family site keeps its own records.
- HTTPS — traffic to the hub and family APIs is encrypted in transit.
- Hashed passwords — family site credentials are not stored in plain text.
- Roles — viewers, editors, and administrators see and change different things.
- Hub gate — inactive or unpaid families can be blocked from sign-in at the control plane.
- Service keys — machine access between hub and family apps uses shared secrets, not member passwords.
What you should do
- Use a unique password for your Olulyo account.
- Administrators: remove accounts for people who leave the family circle.
- Do not share administrator credentials.
- Install the Android app only from our download page or an official store listing we publish.
Report a vulnerability
Email support@toughblue.com with subject Olulyo security. Please include enough detail to reproduce the issue and avoid accessing other families’ data beyond what is needed to demonstrate the problem.