Last updated: 2026-07-10
Payments are processed securely by Stripe and/or PayPal. Your card details are entered directly into their secure hosted fields. We never receive, store, or display your full card number, CVC, or expiry. For card payments we use 3-D Secure (SCA), as required for online card transactions in Japan and the EU.
Access to our infrastructure (hosting, payments) is limited to the owner and protected by two-factor authentication on the underlying dashboards (Cloudflare, Stripe, PayPal, GitHub). Sign-in and invite endpoints are rate-limited to resist brute-force and abuse.
The site is served over HTTPS with strict transport security and hardened response headers (Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy). We store only the minimum needed — see our Privacy Policy.
Found a security issue? Please email [email protected] with details. We appreciate responsible disclosure.