Trust center
Security
What ChitPal actually does to protect your account, your conversations, and your money — described honestly, with no borrowed badges.
How your account is protected
Passwords are never stored — only a scrypt hash with a unique random salt, so even a database leak wouldn't hand anyone your password. Signing in issues an opaque session token in an HTTP-only cookie (flagged Secure in production), and every request that changes data or reads private content verifies that session server-side — a browser can't act as another user. Sessions are revocable, and you can sign out of every other session from Profile → Active sessions.
The minimum we store
We store what ChitPal needs to run — your profile, conversations and media, Moments, learning activity, and reports — in PostgreSQL, and nothing extra. There are no advertising or analytics trackers in the app, we don't sell personal data, and the complete inventory (plus how private messages are handled) is spelled out on the Privacy page.
Encrypted in transit
ChitPal is served only over HTTPS — plain HTTP requests are redirected before anything loads — and session cookies carry the Secure flag, so they only ever travel over an encrypted connection. Requests that touch private data also check the request origin, and cross-origin calls are rejected.
Payments, handled by PayPal
Premium passes are processed entirely by PayPal Checkout. Card and bank details never touch ChitPal's servers — we couldn't see them if we tried. We store only what reconciliation needs: order ID, capture ID, amount, currency, status, payer email, and membership dates. Webhooks that update payment status are verified before they're trusted.
Rate limits and abuse guards
Registration, sign-in, reports, translation, and message sending are rate-limited, so brute-forcing passwords or flooding the community is expensive and loud. Admin access exchanges the console key once for a signed, short-lived, HTTP-only moderator cookie — there is no standing admin session to steal.
Blocking and reporting, built in
You can block any partner from their profile — blocking hides both accounts from each other and cuts all contact in both directions until you undo it. Reports share only the specific message, voice note, or Moment you select, never the rest of your conversation, and every moderator reveal of private content requires a case purpose and creates an append-only audit event.
Report a security issue
Found something that looks like a security hole? Email samjo4500@gmail.com with what you found and how to reproduce it, and a human will dig in. Please test only against your own account and the public pages — not other people's accounts or data. We don't run a paid bug bounty and we won't pretend to; we do promise to read every report and tell you what we found.