Trust, Security & Privacy

User accounts sign in with email + password or one-time email codes (OTP). Admin sign-in is OTP-only and the admin role is re-verified on the server before access is granted.

Sessions are issued and refreshed by our managed authentication provider. You can sign out at any time from your account menu.

Database access is protected by row-level security policies. Each user can only read or modify their own profile, deposits, withdrawals, and referral data.

Admin-only operations require a verified admin role that is stored separately from user profiles and checked server-side.

To run your account we store: your name, email, phone, referral code, deposit/withdrawal records, course progress, and payment proofs you upload.

We do not sell personal data. Data is used to operate the service, distribute referral commissions, and provide support.

The application is hosted on the Lovable platform. Database, authentication, file storage and server functions are provided by our managed backend (Supabase) on Lovable Cloud.

Email delivery and payment screenshots are processed by these same managed services.

Account and transaction records are kept while your account is active and for as long as required for accounting, dispute resolution, and legal compliance.

To request deletion of your account or data, contact us using the email below and we will respond within a reasonable time.

Found a security issue or have a privacy question? Please reach out through our contact page so we can investigate.

Please do not publicly disclose suspected vulnerabilities before we have had a chance to respond.