Passwords

We Never Store Your Raw Password

When you register, we hash your password with bcrypt at cost factor 12 — that's 4,096 rounds of salting and hashing. Even if our database got leaked (which it won't, but still), cracking your password would take centuries, not hours.

We never log, email, or store your password in plaintext. Not in server logs, not in error reports, not in a sticky note on the monitor. I literally cannot see your password. If you forget it, I can only reset it — I can't tell you what it was.

Authentication

JSON Web Tokens (JWTs)

After you log in, we give you a signed JWT token that expires after 24 hours. It's stored in your browser's session storage (not a cookie — cookies are annoying) and sent with every API request. The token contains only your user ID and role — no personal info.

The token is signed with a server-only secret key that never leaves Cloudflare Workers. If someone steals the token, it's useless after 24 hours. If they try to modify it, the signature breaks and we reject it.

Data Storage

Where Your Data Lives

We use Turso — a distributed SQLite database built on libSQL. Your data is stored in a secure cloud environment with encryption at rest. Our API runs on Cloudflare Workers, which means:

• No persistent server to attack
• Automatic DDoS protection
• Global edge network for fast responses
• No direct database access from the internet

Cookies

Minimal Cookies, No Tracking

This site uses a single cookie preference stored in your browser's localStorage — not a tracking cookie. We have zero analytics scripts, no Google Analytics, no Facebook pixels, no ad trackers.

The only data we store locally is your session token (for keeping you logged in) and your cookie consent preference. That's it.

Accounts

We Don't Ask for Your Email

We removed email from the signup process entirely. You only need a username and password to create an account. No email to hand over, no inbox to check, no spam risk.

If you forget your password, reach out in our Discord and staff can reset it. Less friction for you, less data on our servers.

Your Control

You Can Delete Everything

You have full control over your data. From your Profile Settings page, you can:

• Change your password — anytime, no questions asked
• Delete your account — permanently removes your account, tickets, server listings, and all associated data

Account deletion is immediate and irreversible. We don't keep backups of deleted user data.