Security: what we do, no fluff

Accounts & sessions

• Irreversibly hashed passwords (never stored in plain text).
• Sessions with short-lived tokens and per-device rotating refresh.
• Email verification before unlocking all features.

Payments

• Payment and subscription management happen in Stripe, not Metruta.
• Your card details never touch our servers.
• You cancel yourself from the Stripe portal, no need to ask.

Exams & cheating

• The answer key never reaches the browser before submit.
• Each submission applies exactly once: retries and crashes never duplicate XP.
• The public demo answers with the key already removed.

Abuse & limits

• Rate limits on auth, AI and billing.
• Origin verification (CSRF) on sensitive operations.
• Audit log on payments and admin access.

Who else touches your data

• Stripe: Processes payments and subscriptions.
• Groq: Generates AI responses (explanations, plans).
• MongoDB: Stores accounts, answers and progress.
• SMTP provider: Sends verification and reminder emails.

Found an issue?

No system is perfect. If you see something odd, our responsible-disclosure policy explains how to tell us safely.