Security at UNKRE

Account protection

• Sign-in uses Google or Telegram. We never receive your Google or Telegram password.
• Session cookies are HttpOnly, SameSite and, in production, Secure. JavaScript cannot read the access or refresh token.
• Refresh tokens are rotated, stored as hashes and limited to the session lifetime. A used refresh token cannot be replayed.
• State-changing requests use a signed CSRF token in addition to the session cookie.
• Rate limiting, temporary IP bans and request validation reduce credential stuffing and automated abuse.

Payments

• Card payments through Telegram are handled by Telegram. We do not receive or store full card numbers.
• Crypto checkout is handled by ATLOS. We store the order and transaction metadata needed to credit your balance and support a refund.
• The credit ledger is append-only at the application level: purchases, spends, refunds and adjustments are recorded with before/after balances.
• Payment confirmation is verified by provider signature or secret, not by a browser redirect.

Images and prompts

• Reference photos are sent to the generation provider to create the requested image. They are not used to build a public profile.
• Generated images are cached on our infrastructure for a short period, usually no more than 24 hours, so your browser can save a copy.
• Your browser library uses IndexedDB on your device. Clearing site data removes that copy.
• Deleted generations are removed from the service and from the temporary cache where available.

Infrastructure

• Production traffic uses HTTPS. The public origin is behind Cloudflare and an nginx reverse proxy.
• Databases and internal services are not exposed to the public internet. The admin panel is bound to the local machine only.
• Access to production systems is limited to the operators who need it. Credentials and tunnel tokens are kept out of source control.
• Dependencies and container images are reviewed and updated as part of maintenance.

What we do not do

• We do not use advertising cookies or third-party behavioral tracking.
• We do not sell personal data.
• We do not store full card numbers or your Google/Telegram password.
• We do not claim that any online service is perfectly secure.

Report a vulnerability

Email [email protected] with [Security] in the subject line. Describe the issue, the affected URL or component and a safe way to reproduce it. Do not access other users’ data, degrade the service, use social engineering or test third-party providers without their permission.

We review good-faith reports and will explain the outcome where we can. Please give us reasonable time to fix the issue before publishing details.

Incident response

If we confirm a security incident affecting personal data, we will contain it, assess the impact and notify affected users and authorities where required by law. We may reset sessions or require re-authentication as a precaution.

Contact

Security questions: [email protected]. For privacy requests, use the Privacy Policy; for abuse reports, use the Acceptable Use Policy.