Privacy Policy

Last updated: November 13, 2026

1. Data We Collect

Account information: Your username and email address when you sign up or log in with Google.
Password (one-way hash only): Your password is never stored in plain text. It is immediately hashed using scrypt with a unique random 16-byte salt, making it unreadable to everyone—including site administrators.
Google OAuth ID: If you sign in with Google, we store your Google account identifier (sub) and email to link your account.
Session cookie: A random HttpOnly; Secure; SameSite=Lax session token (mazal_session) used strictly to keep you signed in.
Security rate-limiting: Temporary failed-login counters (IP address and username/email) are stored for up to 15 minutes to block brute-force attacks (3 failed attempts).

All traffic is encrypted in transit via HTTPS/TLS.
Passwords use one-way cryptographic hashing (scrypt) and cannot be decrypted.
Session cookies are HttpOnly and Secure, preventing JavaScript access (XSS) and cross-site request forgery (SameSite=Lax).
Strict security headers (CSP, X-Frame-Options: DENY, X-Content-Type-Options: nosniff) are enforced.
We do not sell, rent, or share your personal data with third parties.

You can accept or refuse cookies using the banner on our pages. Strictly necessary session cookies are only set when you log in.

To request account or data deletion, contact [email protected].