What we store
- Your email address and, if you give one, your name.
- A one-way hash of your password (argon2id). We never store or log the password itself.
- If you sign in with Google: your Google account identifier, name, email and profile picture address.
- Session records, so you stay signed in, and an encrypted two-factor secret if you turn two-factor on.
- Failed sign-in attempts, keyed by email and by network address, kept for at most a day to limit password guessing.
Who processes it
The site runs on Vercel, the database on a hosted Postgres provider, and emails are sent through Resend. We do not sell your data and we do not run advertising trackers.
Your choices
You can change your name and password and turn two-factor on or off from your account page. Account deletion and data export requests will be handled by email once this policy is final.