Security is part of the product, not a footer checkbox.
Account isolation
SubTrack uses authenticated server operations and Supabase Row Level Security on user-data tables. Reward and Premium changes are processed on the server after user authentication rather than trusting a browser-provided balance.
Secrets
Server credentials and provider secrets are intended to remain in server-side environment variables. Publishable browser keys are treated differently from privileged service credentials and should not grant unrestricted database access.
Optional Gmail connection
Gmail access is optional and is used for receipt/subscription detection when you choose to connect it. Disconnecting inside SubTrack removes the stored app connection; revoking the Google authorization from your Google account removes provider authorization.
Responsible disclosure
If you discover a vulnerability, please do not access, alter or retain other users' data. Send a concise report with reproduction steps and impact to security@nanoqt.app. We will use the report to investigate and remediate legitimate issues.
Limits
No internet service can promise absolute security. SubTrack uses layered controls and reviews platform security findings, but security depends on the application, providers, user devices and account security together.