How your account and data are protected

Several protections run automatically on your account:

• Passwords are never stored in plain text. They are hashed with bcrypt (a strong, salted algorithm), so no one — not even staff — can read your password. Support can reset it but never see it.
• Encrypted connection. The site is served over HTTPS/SSL, and a strict-transport-security policy forces browsers to always use the secure connection.
• Login abuse protection. Sign-in attempts are rate-limited both per account and per network, which blocks password-guessing (brute-force) and credential-stuffing attacks. Failed logins return a generic message so attackers can't tell whether an email exists.
• Live account checks. Your session is re-validated on the server on every request, so if an account is blocked, access is cut off almost immediately.
• Browser hardening headers. The app sets protections such as clickjacking prevention (X-Frame-Options: DENY), MIME-sniffing protection, and a restrictive permissions policy.

Your data is handled in line with GDPR. The single biggest factor you control is your password — keep it strong and unique.