Security

• Passwords: salted PBKDF2-SHA256 (20,000 iterations) mixed with a server-side secret; never stored in plain text (S-2).
• Sign-in links and reset links: single use, expire after 15 minutes, stored only as keyed hashes (S-2).
• Session cookie: HttpOnly, Secure, SameSite=Lax, scoped to the API; at most 3 signed-in devices, each revocable by you (S-2).
• Turnstile anti-bot check on sign-up, sign-in, password reset, Google sign-in start and the contact form (S-2/S-6).
• Application rate limits on sign-in, sign-in links, password reset, contact messages, invoices and sync (S-2/S-3).
• Admin panel: mandatory authenticator-app two-factor, a fresh code for every change, append-only audit log (S-3).
• Candles and tick data stay on your device; only light data syncs, and only after you agree (D-15/S-2).
• Self-service data export and account deletion (access ends immediately; data is purged 30 days later) (S-2).
• Crypto billing never connects to your wallet: payments are read from public blockchains, and only genuine USDT counts (S-3/D-05).

Every claim names the phase that implements it; controls that are not shipped are not listed. There are no separate database backups yet beyond the database provider's short built-in recovery window.