Where your data lives
Application data is stored in Cloudflare D1 and file attachments in Cloudflare R2 object storage, both served from Cloudflare's global network.
Encryption in transit
All traffic is served over HTTPS/TLS 1.2+ through Cloudflare. Plaintext HTTP is redirected.
Password storage
Passwords are hashed with PBKDF2-SHA256. We never store or log plaintext passwords.
Bot protection
Sign-in, sign-up and password-reset forms are protected by Cloudflare Turnstile human verification.
Rate limiting
Sensitive endpoints are rate-limited per IP: 10 requests per minute and 30 per hour, returning HTTP 429 when exceeded.
Your GDPR rights
You can export all of your data as JSON and delete your account at any time from the Account Center.
Payments & data processing
Payments are handled by Paddle as Merchant of Record. Card data never touches our servers.
Contact
Questions about security or a DPA? Reach us via the contact email listed in the privacy policy.