Security & Trust

• Email and password sign-in plus Google sign-in, handled by a managed authentication service; we never see or store your Google password.
• Passwords are stored only as salted hashes by the auth provider.
• Dashboard routes are protected and redirect to sign-in when there is no valid session.

• Every private table enforces per-row access rules, so one account cannot read or modify another account's cards, leads or analytics.
• Public card pages expose only published cards and only the fields the owner chose to publish.
• Lead records and analytics rows are readable by the owning account only; they are never exposed to anonymous visitors.

• Lead submissions and analytics events are validated on the server before anything is written.
• Lead forms include a hidden spam trap and a per-card submission rate limit.
• Card content is rendered as text, never as raw HTML, and outbound links are forced to a safe scheme.

• Uploads go to a private storage bucket, namespaced per account and per card.
• File type and size are checked before upload; public access is granted through time-limited signed links only.

Engagement analytics are event counts, not visitor profiles. The browser identifier used to estimate unique visitors is one-way hashed with a server-only secret before storage, so it cannot be reversed into an individual.

We secure the platform. You are responsible for choosing a strong password, deciding what to publish on your card, and handling the contacts you collect lawfully. Anything you place on a published card is public by design.

If you believe you have found a security issue, email mattobial@gmail.com with steps to reproduce. Please do not publicly disclose it before we have had a reasonable chance to respond, and do not access or modify data that is not yours while testing.