Security Policy

Last updated: 2 November 2026

This policy is from Zedapex Limited, Lagos, which operates Joinvoo. It explains how we protect the Service and how to report a vulnerability.

1. How we protect Joinvoo

• Encryption: every connection uses HTTPS. Team inbox messages, Telegram bot tokens, secret settings and the sign-in tokens of ad platforms you connect are stored encrypted.
• Passwords and keys are stored only as one-way hashes. You can turn on two-step login with an authenticator app, and we email you about new logins.
• Single sign-on: you can sign in with your VooSquare Voo ID, the one account shared across Zedapex tools.
• Limited staff access: our team sees only what its role needs.
• Payments: card details are entered on the payment provider’s page and are never stored by us.
• Signing records: every acceptance of the Terms is stored with a tamper-evident receipt.

No online service can be made completely secure. Section 12 of the Terms and our Data Processing Agreement explain what we do if an incident affects your data.

2. Your part

• Use a strong, unique password and turn on two-step login.
• Keep your login links, bot tokens, pixel access tokens and API keys private, and revoke the ones you no longer need.
• Give each teammate their own login and remove access when someone leaves.
• Tell us straight away if you think someone else used your account: [email protected]. We will never ask for your password or login codes.

3. Reporting a vulnerability

Send your report to [email protected] with the subject “Security report”: what you found, where, the steps to reproduce it and what an attacker could do. We will confirm we received it, keep you updated and tell you when it is fixed.

4. Rules for good-faith research

• Test only with accounts you own.
• Never access, change or delete other customers’ data; stop and tell us if you reach it.
• No denial-of-service, spam, social engineering or physical attacks, no messages to real Telegram users, and no testing of the systems of Telegram, ad platforms or our other providers.
• Give us reasonable time to fix the issue before telling anyone else.

If you follow these rules, we will not take legal action against you for your research. We do not run a paid bug bounty at the moment, but we are glad to thank researchers publicly with their permission.