1. What we collect
An email address (or OAuth subject), a display name, an avatar URL, your referral code, and a record of your mining sessions. That's it.
2. What we don't
We don't sell data, we don't fingerprint your device, and we don't ship third-party trackers on logged-in pages.
3. Cookies
Session cookies (httpOnly, secure) keep you signed in. No advertising cookies.
4. Your rights
Request export or deletion any time via /contact. We respond within 30 days.
5. Security
All tables are protected by row-level security. Sensitive operations are server-validated. Admin actions require TOTP.