Last updated: April 2026
If you believe you have found a security vulnerability or know of a personal data breach affecting April, please email hello@yourapril.co.uk with the subject line "Security" and a description of the issue.
We aim to acknowledge security reports within 24 hours.
We monitor for breach indicators including unauthorised access logs, anomalous database activity, third-party security advisories, and direct user reports.
On confirmed detection, the immediate priority is to contain the breach: revoke compromised credentials, disable affected access tokens, and isolate any compromised systems within one hour where technically feasible.
Within 24 hours of detection we assess the scope: which users are affected, what data may have been exposed, the likely cause, and the severity in line with ICO guidance on personal data breaches.
Where the breach involves personal data and is likely to result in a risk to people's rights and freedoms:
We document the root cause and implement fixes to prevent recurrence. The remediation report is shared with affected users and regulators on request.
Within seven days of containment we publish a brief summary on this page including the date, scope, root cause, and remediation steps taken.
The designated contact for security and breach matters is the founder, Sean McNamara.
Email: hello@yourapril.co.uk
No reportable security incidents have occurred to date.
This policy is reviewed at least annually and after any reportable incident.