Security Policy

All traffic between your device and our servers is encrypted in transit using TLS. Your personal data is stored on databases that encrypt data at rest (managed by our hosting providers). We also serve strict security headers (including HSTS in production) and a restrictive Content Security Policy.

Sign-in and session management are handled by Clerk, a dedicated authentication provider. We protect state-changing requests with same-origin CSRF checks and rate limiting on all API endpoints, and administrative surfaces additionally require a recent second-factor verification (via an HMAC-signed, 24-hour security cookie issued only after an email code, authenticator app, or passphrase check). Session tokens and security cookies are signed with HMAC-SHA256, and our logout flow revokes the session and clears authentication cookies and device storage.

Token balances are authoritative server-side. Purchased tokens (if enabled) enter a balance only through a signature-verified payment webhook: each event is authenticated with an HMAC signature and a replay-window timestamp, and idempotency keys ensure a retry can never double-credit. We do not store card numbers or other payment instrument details — payment processing is handled by third-party processors that are PCI DSS compliant, and direct client-driven balance changes are disabled.

Our platform runs on managed cloud infrastructure (Vercel) with a serverless Postgres database (Neon/Vercel Postgres) and a managed cache (Upstash Redis). We rely on our providers' network security, including DDoS protection, and we apply database row-level security and parameterized queries to prevent injection. Access to production systems is limited, and administrative actions are recorded in an audit log.

We take a defense-in-depth approach: automated security tests run as part of our CI (input validation, media sanitization, authorization checks, CSRF and rate-limit tests, and webhook signature verification), dependencies are pinned and kept updated, and security fixes are applied promptly. We regularly review our code and follow security best practices in the frameworks we use.

We collect only the minimum data necessary to provide our services, retain it only as long as needed, and delete or anonymize it when it is no longer required (including a routine retention sweep of finished match records and full erasure on account deletion). See our Privacy Policy for details. We log security events to detect unauthorized access, and we purge or anonymize personal data from those logs where required.

We monitor our services for errors and anomalies (including Sentry and health checks) and respond to security incidents as they are identified. In the event of a data breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

We carefully vet the third-party services we rely on (authentication, hosting, database, caching, analytics, error monitoring, email, and support chat) and limit the data we share with them to what is necessary to provide our services. Our third-party agreements require appropriate data-protection safeguards.