Trust, Security & Privacy

Account & authentication

• Email + username + password sign-in; passwords are hashed by our auth provider, never stored in plaintext.
• Sessions use short-lived tokens that refresh automatically and can be revoked by signing out.
• Admin actions require a server-side role check; client-side flags cannot grant privileges.

Data we store

• Profile basics you provide (name, username, optional call sign, persona).
• Your learning progress: quiz attempts, module completion, badges earned.
• Optional newsletter opt-in preference.

We do not sell your data. We do not share personal data with third parties for advertising.

Database security

• Row-Level Security is enabled on every user-data table; you can only read and modify your own rows.
• Badges and other privileged grants are issued only by server-side functions that validate eligibility — they cannot be self-awarded through the API.
• Secrets and service keys are kept server-side and never shipped to the browser.

Your controls

• Edit your profile and newsletter preference from the Account page.
• Request account deletion or a data export by contacting us (see below).

Usage analytics

• We record which pages, cards, and tools were opened so we can improve the parts of HamCompass people actually use.
• Each visit gets an anonymous session identifier that lives only in your browser tab and is discarded when you close it.
• We record that a callsign lookup happened — never the callsign you searched.
• No personal data, no cross-site tracking, no advertising networks, and no third-party analytics profiles.

Reporting a security issue

If you believe you have found a security vulnerability, please contact the HamCompass team so we can investigate. Please do not publicly disclose issues before we have had a chance to respond.