MyHappySkyA public service by AguiCorp

Security Policy

Version 1.0.0 · Effective November 6, 2026

About this policy

Effective date: November 6, 2026 · Last updated: November 6, 2026 · Version: 1.0.0

This policy tells security researchers how to report a vulnerability in MyHappySky at https://www.myhappysky.com, and what we do with a report. MyHappySky is operated by AguiCorp, LLC. Our machine-readable contact file is at /.well-known/security.txt.

1. How to report

Email [email protected] with:

  • the page or address affected;
  • what you found, and the steps to reproduce it;
  • what an attacker could do with it;
  • how we can reach you.

Please don't put details of an unfixed vulnerability in our contact form or on social media.

2. What we commit to

  • Acknowledgment within 72 hours of your report.
  • Triage and fix targets: high-severity issues fixed within 30 days; medium-severity within 90 days; low-severity in a following release.
  • Updates: we tell you when we've confirmed the issue and when it's fixed.

3. Scope

In scope: www.myhappysky.com and myhappysky.com.

Out of scope:

  • other AguiCorp properties and services, including BillingSky, which have their own policies;
  • third-party services we use, such as Cloudflare, DigitalOcean, Stripe and Google, which you should report to them;
  • denial-of-service attacks, volume testing, and spam;
  • social engineering of AguiCorp staff or users, and physical attacks;
  • reports from automated scanners with no proof of a real impact.

4. Rules for testing

This is a service for children and their families, so please:

  • use only your own parent account, and never try to reach another family's account, child profile, or progress history;
  • view, copy or keep only the minimum data needed to show the problem, and delete it when you're done;
  • stop and report as soon as you reach any personal information that isn't yours;
  • not degrade the Service for anyone else;
  • give us reasonable time to fix the issue before telling anyone else.

5. Good-faith safe harbor

If you follow this policy, we will treat your research as authorized and in good faith, we will not take legal action against you for it, and we will not ask anyone else to. If a third party brings a claim against you for research that followed this policy, we will make it known that your work was authorized by us.

6. Rewards and thanks

We don't run a paid bug bounty. With your permission, we will thank you by name on this page once the issue is fixed.

Thanks: no reports yet.

7. Contact

  • Security reports: [email protected]
  • Phone: 407-751-1551 (voice messages)
  • Mail: AguiCorp, LLC, Attn: Security, P.O. Box 620101, Orlando, FL 32862, USA

For how we notify people about a security incident, see our Security Incident and Breach Notification Policy.