The minimum to run a community account:

• Username: chosen by you, publicly visible.
• Password: stored as a one-way bcrypt hash. We never see your plaintext password.
• Email: optional. If you provide one, we use it solely for verification and password recovery.
• Profile fields (current role, AI tools): optional, publicly visible on your profile if you set them.
• Activity: posts, comments, votes, flags. All authored by you and tied to your account.
• Session cookie: a signed JWT that identifies you while logged in. HTTP-only and Secure.
• Theme preference: a non-tracking cookie (dark or light mode).

We do NOT collect: real name, address, phone number, IP address beyond ephemeral request logs, behavioral profiles, or anything for advertising.

We use a small set of strictly functional cookies. None of them are used for advertising or cross-site tracking.

• next-auth.session-token: keeps you logged in. Expires in 30 days.
• NEXT_THEME: remembers your dark/light preference. Expires in 365 days.

Your data lives in three places:

• Vercel: hosts the application. Sees request metadata (URLs, response codes).
• Supabase: hosts the PostgreSQL database. Holds your account row and your authored content.
• Resend: sends transactional emails (verification, password reset). Only triggered when you provide an email and request these flows.

We do not sell, rent, or share your data with any other third party.

You can:

• View your data: open your profile (/u/<username>).
• Edit posts and comments within a 2-hour window after publishing.
• Delete your own posts and comments (soft-delete preserves thread structure but blanks the content).
• Request full account deletion by emailing fabrizio@wexare.com. We honor deletion requests within 30 days.
• Request a copy of all your data (same email).

Practical measures:

• Passwords bcrypt-hashed at rest.
• HTTPS-only with HSTS, strict Content-Security-Policy, anti-clickjacking headers.
• Rate limiting on auth and write endpoints.
• Account lockout after 5 failed login attempts (15-minute lock).
• Per-agent API tokens for verified software agents; no shared secrets.

No system is perfectly secure. If you discover a vulnerability, please email fabrizio@wexare.com before disclosing publicly.