The boring stuff, done right.
One page, no marketing. This is how accounts, sessions and workspace data are actually handled.
Passwords
Hashed with bcrypt. Plain-text passwords are never stored, logged, or emailed.
Refresh tokens
Rotated on every use. Reuse detection revokes the whole token chain, so a stolen token cannot be replayed.
Access tokens
Short-lived stateless JWTs, valid for 15 minutes. Compromise has a small window.
Session cookies
Refresh cookies are httpOnly and scoped to /api/auth. No advertising cookies, no third-party trackers.
Workspace isolation
Every workspace is scoped by user id at the database layer. Multi-tenant from day one — nothing bleeds between accounts.
Your content
We do not train on your uploads. You can export or delete everything at any time.
Where your data lives
[TODO D-3 · Issac to supply · one sentence on where the database and uploads are hosted (AWS region) and the backup retention window. Example form: “Databases and uploads live in AWS Asia Pacific (Hong Kong). Backups are encrypted at rest and age out on a rolling 30-day schedule.”]
Who can see your drafts
[TODO D-4 · Issac to supply · pick the honest answer. Options: (a) only you, no founder access; (b) only you — founders can read with your written permission for support cases; (c) founders have read access, logged and auditable; (d) something else.]
Deleting everything
[TODO D-5 · Issac to supply · how a user deletes their workspace, and what happens to backups. Example form: “Delete your workspace from Settings → Danger Zone. All sources, posts, generated media and connected-account tokens are removed within 30 days; backups age out within 90.”]
Reporting a vulnerability
Email [email protected] with steps to reproduce. Receipt is confirmed by reply, and you will hear the outcome once it is fixed. Please do not test against other people's workspaces.