Privacy

We store the email address, display name, timezone, password hash, and optional authenticator secret needed to run an account. Date of birth, phone, address, bio, favourite team, and profile photo are saved only if you add them.

Session cookies are HttpOnly. We do not put access tokens in browser storage.

Logs redact passwords, tokens, and reset links. Audit history records administrative changes to roles, rules, and scores.