Privacy

The account stores the provider login, a username, and an optional avatar. The phone number is stored encrypted and is not returned to the browser. Two-factor secrets and recovery codes are stored as protected values, not as plain text in the interface after enrollment.

API keys are stored as hashes. The site can show the prefix, spend, and recent IP addresses seen by that key. It does not show a latency or error-rate number unless that measurement was stored.

Session cookies are HttpOnly. The session token itself is not put in pages or redirects.