Security
What is in place today, explained plainly. Nothing here is a promise about later.
Every page and request travels over HTTPS, and browsers are told never to use anything else (HSTS).
Every table in our database has access rules switched on: an account reaches only what belongs to it. A test checks this on every change.
You pay on Stripe's own checkout page. We never see or store your card number.
Sign-in is handled by our authentication provider (Supabase). Passwords are stored hashed: nobody can read them, us included.
Attempts to sign in, create accounts, reset passwords and request offers are limited per device and per account, so nobody can try thousands of guesses.
A reward is given only when your staff type the guest's six-character code at the counter. A link alone gets nothing.
No advertising cookies, no third-party analytics. Pages run only our own code, and the site can't be framed inside another one.
The database, sign-in and files are on Supabase, in the EU where available; the site runs on Vercel.
The AI that writes your offers (Claude, by Anthropic) receives only what each task needs, such as your venue's details, and does not use it to train its models.
From your account you sign out of every device and delete the account whenever you want: the plan is cancelled in Stripe first, then the data is deleted.
SocialPerks