[Operator name — to be provided by the owner] · [contact@example.com]
Last updated: draft for product-reviewed behaviour. Not a claim of legal certification.
Passwords are stored as salted hashes. Sessions use signed access tokens with an expiry. Access tokens are never logged.
API keys, payment secrets and database credentials live in environment configuration, never in source control or front-end bundles.
User-scoped endpoints require authentication; entitlements are enforced server-side; admin endpoints are restricted to designated admin accounts.
CORS is restricted to configured origins; error messages avoid internal detail; audit events are retained for billing and security review.
Security concerns should be reported privately to [contact@example.com].
STOKIO keeps a session cookie and stores lightweight preferences (theme, log-in token) in your browser. No marketing or tracking cookies are used. Read the cookie policy