A short overview of how protection works. For data details, see the Privacy Policy.
Your account data
- Each account is separated from the others in the database itself. The rule is checked on every request, so even a bug in the interface cannot show someone else’s records.
- Data is stored in Russia, in Selectel data centres. The database is backed up daily.
- Files are served through signed links that expire.
- All connections use HTTPS only.
Sign-in
- Passwords are stored only as hashes. Sign-in attempts are rate-limited.
- Passkeys — Face ID, Touch ID, Windows Hello. A passkey is bound to the service address, so a fake site cannot use it. Biometrics never leave your device.
- We email you when passwordless sign-in is added to your account.
- Settings include “Sign out on all devices”. A password reset ends all sessions.
Team
- A team member sees bookings and clients but not prices, payments or finances — they are not in the data their browser receives.
- When a member is removed or their role changes, their access and the data copies on their devices stop working at once.
On your device
To start quickly, the app keeps a copy of your data in the browser, encrypted with a key stored on the server: without a valid sign-in it cannot be read. The copy is erased when you sign out and after 30 days without sign-in. On a shared computer, choose “Someone else’s computer” on the sign-in screen and nothing is kept.
Galleries
A gallery link can be protected with a password and an expiry date. The watermark stays until the order is paid.
Payments
Card details are entered on the YooKassa page and never reach us. For auto-renewal we keep only the payment method ID and a masked card number.
Found something?
Write to [privacy email] with the subject “Security”. We will reply and tell you what we fixed.