Accounts
Sign-in uses Supabase Authentication. Passwords are stored as hashes, sessions are kept in secure cookies, and pages that need a signed-in user check the session on the server.
Your data is separated
All data lives in a managed Postgres database with row-level security. Each person can read and change only their own cards, leads and events. Plan limits, such as the number of cards and links, are enforced in the database and not only in the interface.
Safe content
Links on cards are normalised so that unsafe schemes such as javascript: are never produced. Uploaded images are restricted to common image types and a 5 MB size limit. Public pages are rendered with escaped content.
Safe exports
Lead exports neutralise spreadsheet formulas so a malicious entry cannot run code when you open the file in Excel or Sheets.
In transit
All traffic is served over HTTPS.
Reporting a vulnerability
If you find a security problem, please tell us through the contact page, starting your message with SECURITY, and give enough detail to reproduce it. Please do not access other people's data or disrupt the service while testing. We will acknowledge your report and work to fix valid issues promptly.
These documents are provided by Hello Marketing, Vadodara, Gujarat, India. See all legal documents.