Security

tumbuh keeps public discovery separate from the private app

Public tumbuh pages only show safe brand information and previews. Core features, personal data, and interactions still require authentication.

Public preview only

SEO pages should only include public, sanitized content, not private feed responses or full personal data.

No sensitive data

Email, phone numbers, tokens, chat, recommendations, connection graphs, private media, and internal scores must not appear in public HTML.

Crawlers get no special access

Crawlers and logged-out users should see the same public content. There is no private content just for bots.

Authentication remains required

Chat, settings, notifications, profile editing, connections, recommendations, and analytics stay behind authentication.