Security & privacy at MyStacks

• Sign-in uses email and password. Passwords are hashed by our backend provider — we never see or store them in plaintext.
• New passwords are checked against the Have I Been Pwned database and rejected if they appear in a known breach.
• New accounts go through an Apply-to-Join review before they can publish public stacks.

• We store the data you give us to run your account: profile fields, the stacks and products you create, and click analytics on your own affiliate links.
• Sensitive account fields (plan, status, Stripe IDs, approval state, referral metadata) can only be changed by you through the app's UI flows or by an admin — they are not writable directly from the public API.
• Private files you upload (digital products, avatars, stack images) live in private storage buckets. Digital product files are only delivered through short-lived signed URLs after a completed purchase.

• Card payments and creator payouts are processed by Stripe. We never see or store full card numbers.
• Creator payout connections use Stripe Connect Express. You control the underlying Stripe account.
• Webhooks from Stripe are verified with a signing secret before we update any order or earnings record.

• We record pageviews and link clicks to power your analytics dashboard. Only you (and admins) can see your own numbers.
• We do not sell your data and we do not run third-party ad tracking on your stacks.

• Hosting & edge runtime: Lovable Cloud (Cloudflare-backed).
• Database, auth, storage: Supabase.
• Email: Resend.
• Payments: Stripe.
• Page scraping (creator-initiated): Firecrawl.

You can delete your own stacks, products, and uploaded files from the dashboard at any time. To delete your account or request a copy of your data, email admin@mystacks.link.

If you believe you've found a security issue, please email admin@mystacks.link with details and reproduction steps. We'll acknowledge as quickly as we can and keep you posted on the fix.