Passwordless sign-in
Verified email access avoids password reuse risk and removes the need to store password hashes for user accounts.
Security boundaries for personal reflection.
Your Inner Synthesis protects sensitive self-reflection by collecting less by default, keeping provider credentials server-side, using verified account access, and routing payments through hosted checkout.
HTTP-only sessions
Session cookies are signed and kept out of JavaScript-readable browser storage.
Server-side providers
AI provider keys and billing credentials stay on the server. Browser code calls same-origin app endpoints.
Hosted payments
Checkout and subscription management run through hosted payment pages, so card details are not collected by this app.
Rate and entitlement checks
Guided reflection and paid features are checked against plan limits before higher-cost processing is returned.
Explicit storage boundaries
Assessment and reflection data starts locally. Account-backed continuity requires a verified profile and clear user choice.
How protected workflows are handled
- Email verification is required before profile sessions are opened.
- Paid entitlements are checked on the server before paid features are used.
- AI reflection requests are sent through server routes, not browser-exposed keys.
- Billing changes happen in hosted provider pages.
- Consent changes, exports, deletion requests and billing events are recorded for audit review where account storage is active.
- Non-diagnostic and crisis boundaries remain visible around reflective tools.
What you can do
- Use browser-local mode when you do not want account continuity.
- Export available account records before deleting data you want to keep.
- Use the billing portal for subscription changes.
- Clear browser storage to remove local-only saved results from this device.
- Avoid entering emergency, medical, legal or third-party secret information into reflection prompts.
Operational checks
Production releases should pass the build, restart cleanly under PM2 and respond through the public domain before being considered live.
Security is shared
Keep access to your email account secure, use trusted devices for sensitive reflection, and avoid sharing exported reports with people who should not see them.