Quiet, boring, careful security.
This page is maintained by OnScreenGames to answer common security and privacy questions about the platform. It describes practices in place today and is not a certification or independent audit.
Authentication
Email + OAuth via managed identity provider. Sessions are JWT-based with short expiry and refresh rotation. Admin actions require server-side role checks, not client flags.
Data isolation
Every account is row-level isolated in Postgres. Database policies (RLS) scope reads and writes to the signed-in account; service-role keys are never exposed to the browser.
Hosting & uptime
Static assets and server functions run on a managed edge platform. Database is managed Postgres with daily encrypted backups. We target 99.9% monthly uptime.
What we don't do
We don't sell personal data. We don't load third-party ad trackers. We don't use captured leads to market our own services.
Email integrity
Transactional and product email is sent over authenticated domains (SPF/DKIM). Marketing email includes a one-click unsubscribe link.
Responsible disclosure
Found a vulnerability? Email will@xponent21.com with details. We investigate every report, won't pursue good-faith research, and credit reporters on request.
Shared responsibility
We secure the platform and the data we hold on your behalf. You're responsible for choosing strong account credentials, embedding widgets on sites you control, and being lawful about what you collect from your visitors.