Trust & Security

• Sign in with email + password or Google. Passwords are hashed and managed by our auth provider — we never see them in plaintext.
• Sessions use short-lived JWTs with automatic refresh. You can sign out at any time from the menu.
• Email verification is required before streaks, badges, and challenge results count toward your profile.

• Your display name, rosters you lock, daily/streak progress, badges, squad memberships, and challenge results.
• Coarse signup signals (hashed IP and device fingerprint) used only to throttle abusive signups.
• Push subscription endpoints (only if you opt in to notifications).
• Billing identifiers from Stripe when you subscribe to Pro. Card numbers never touch our servers.

• Row-level security on every user-owned table — you can only read and write your own rows.
• Authoritative values (scores, season wins, challenge outcomes, subscription tier) are computed server-side. The client cannot self-report them.
• Service-role keys, signing secrets, and Stripe keys live only in server-side environment variables — never shipped to the browser.
• All traffic is served over HTTPS.

• Leaderboard entries, public profiles, verdict submissions, and shared result links display your chosen display name and roster — treat them as public.
• Display names are filtered against a blocklist. You can change your display name in settings.
• OG share links are signed but do not expire, so links you share publicly remain accessible.

• Manage notification preferences and your public profile in Settings.
• Request account deletion or data export by emailing the address below — we'll respond within 30 days.
• Report abusive content via the in-app report button on any roster, verdict, or squad.

If you believe you've found a vulnerability, email security@lockthelineup.com with a description and reproduction steps. Please give us a reasonable window to investigate before public disclosure. We don't currently offer a paid bounty, but we're grateful for responsible reports and will credit you if you'd like.

• Supabase — database, authentication, storage
• Cloudflare — hosting and edge runtime
• Stripe — Pro subscription billing
• PostHog & Sentry — product analytics and error monitoring