How we protect your work, wallet, and data

Sign-in uses managed authentication with email/password and Google sign-in.

Sessions are stored securely in your browser and can be revoked by signing out from Settings.

Passwords are hashed by our auth provider — we never see or store them in plain text.

Every database table that holds user data uses row-level security so users can only read and write their own records.

Wallet balances, withdrawals, escrow, and subscriptions are mutated only through audited server functions — clients cannot edit those fields directly.

Administrative actions require an explicit admin role and are recorded in an activity log.

Withdrawals are rate-limited, capped, and run fraud checks before being queued.

PayPal payouts are processed server-side; payment credentials never reach the browser.

Escrow funds for contracts are locked until the client releases them or a refund is issued.

Sign-up and sign-in are protected by a CAPTCHA challenge to reduce automated abuse.

File uploads (KYC, gigs, marketplace) are validated by size, MIME type, and magic-byte signature.

Suspicious activity can trigger temporary account locks to protect your balance.

We use cookies and local storage strictly required to keep you signed in and remember your preferences.

We do not sell personal data to third parties.

You can update your profile and preferences from Settings at any time.

To request account deletion or a copy of your data, contact us at the address below.

If you believe you've found a security issue, please email us before disclosing publicly. We aim to acknowledge reports within a few business days.

Do not test against other users' accounts, balances, or data.

Security & privacy questions: support@blessgigapp.store

See also our Terms & Privacy and Help Center.