Security

This page describes controls that are actually enabled in this project. It is maintained by TerraMine Calculator to answer common security questions and is not a certification or independent audit.

Our hosting and database platform secures the underlying infrastructure. We are responsible for how the application uses it. You are responsible for keeping your sign-in credentials and device secure.

• Sign-in uses a managed authentication provider with email and password or Google sign-in; we never see or store your password.
• Password reset uses one-time, expiring links sent to your email address.
• Sessions use signed tokens that refresh automatically and can be revoked by signing out.
• Anonymous sign-ups are disabled.

• Row-level security policies restrict every table so users can read and write only their own records.
• Public surfaces such as leaderboards read through narrow, purpose-built functions that expose only display fields — never emails or private stats.
• Administrative tooling is gated behind a separate roles table checked server-side, not in the browser.
• Privileged database credentials exist only in the server environment and are never shipped to the browser.

• All traffic is served over HTTPS.
• Data at rest is encrypted by the managed database and storage provider.
• Support attachments are stored in access-controlled buckets, not public folders.
• Server-side secrets and API keys are held in the platform's secret store.

• Application errors and failed background jobs are captured for diagnosis.
• Internal admin dashboards monitor sync health, performance, and data integrity.
• Rate-sensitive operations such as bulk email are paced and stop cleanly instead of retrying indefinitely.

Email security@terraminecalculator.com with steps to reproduce. Please:

• Give us a reasonable window to fix the issue before disclosing it publicly.
• Use only your own test account — do not access, modify, or delete other players' data.
• Avoid denial-of-service, spam, or social engineering against users or staff.

We do not currently run a paid bug bounty, but we credit reporters who ask to be named.

See the Privacy Policy for what we store and the Data Deletion page for removal requests.