InTheOffice.org is designed to be a simple, free and anonymous office
attendance planner. While the service is intentionally lightweight, security
is still very important to us. The following explains how we protect both your planner
and your data.
Planner Access
Every planner is assigned a unique, randomly generated planner link when it
is created. These links use cryptographically secure
randomness, making them impossible to guess.
Anonymous User Identification
The first time you visit a planner, your browser generates a
cryptographically random identifier (UUID) using the browser's built-in
secure random number generator.
This identifier is stored only on your device using Local Storage. No
account, password or email address is required. You can remove this data at
any time using the Forget my details button at the bottom of
the planner. If you do, you will no longer be able to edit entries that were
previously created from that device.
Editing Your Own Entries
Whenever you save or remove your availability, your browser sends its
anonymous identifier to the server. This ensures only you can modify your availability.
Protecting User Identifiers
Anonymous user identifiers are never shared with other users. When a planner
is loaded, the server simply tells your browser which entries belong to you,
allowing them to be highlighted and edited without revealing anyone else's
identifier.
Server-side Validation
Every request is validated on the server before any data is accepted. This
includes validating planner access, required parameters, permitted values
and input formatting.
What the hell does this all mean?
Basically, InTheOffice.org provides a secure, no-fuss, password-free way to share office
attendance.
