Account protection
The application supports email-link sign-in, optional Google sign-in and two-factor authentication. Team roles limit which actions members can take. Sign-in endpoints use rate limits and account sessions have expiry and renewal rules.
Enable two-factor authentication, keep recovery codes private and give teammates only the access they need. Never send passwords or private integration keys in a support message.
Hosting and connections
The documented deployment uses a Hostinger VPS in India, with Cloudflare in front of public services. Cloudflare Tunnel connects public traffic to application services. Databases use an internal container network rather than public application endpoints.
Public endpoints use HTTPS. This does not mean that every internal connection uses TLS or that every stored record is encrypted. We do not claim a security certification or independently audited security status.
Integration credentials and data
Provider credentials are encrypted by the application using AES-256-GCM. Normalized revenue records use keyed customer identifiers and masked display hints. Raw provider payloads can contain personal information while processing or retrying a delivery.
The default tracker does not set visitor cookies. IP addresses are still processed for location, filtering and visitor identification. Read the privacy notice for the distinction between analytics, account data and revenue data, and for current retention and deletion behavior.
Report a security concern
Email karthisclan@gmail.com with “Security report” in the subject. Include the affected URL, a description and minimal steps to reproduce the issue. Do not include passwords, private keys or unnecessary customer information.
If you encounter another person’s data, stop accessing it and report the issue privately. This page does not authorize intrusive testing, offer a bounty or promise a fixed response time.