Security

We take the security of your data seriously. These are the actual technical measures in place:

• Full encryption in transit (TLS) and at rest.
• Receipt images live in private storage, only ever served via short-lived signed links.
• Row-Level Security policies prevent any user from accessing another user's data, even in the event of an application-logic bug.
• Secure authentication via Apple / Google / email, no plaintext password storage.
• Subscription verification happens entirely server-side — we never trust client-reported subscription state.
• Audit logs for sensitive operations, and rate limiting to prevent abuse.

If you notice a security issue, reach out immediately via the Support page.