Security

Trust is the product. This page summarises how we protect SubTrakr accounts and the subscription data you entrust to us. It complements our Privacy Policy.

1. Authentication

• Passwordless OTP to verified email or phone.
• Optional 6-digit app PIN with biometric unlock on supported devices.
• Server-side session invalidation when you (or support) revoke sessions.

2. What we never store

Full payment-card numbers (PANs) are not collected. Payment methods keep labels and last-four digits for reminders — enough to recognise a card, not enough to charge one.

3. Transport & hosting

Production traffic is served over TLS. Application secrets live outside the database. Operator actions are audited; destructive tenant operations require reasons and confirmation.

4. Your controls

• Change PIN and notification preferences in-app.
• Delete your account with a typed confirmation and a recovery window.
• Contact contact@subtrakr.me to report a suspected compromise.

5. Responsible disclosure

If you find a vulnerability, email contact@subtrakr.me with details and a way to reach you. Please give us reasonable time to fix issues before public disclosure.