How do you protect accounts?

With multiple layers: passwords are never stored in plain text, access is always encrypted, and everyone can only see what corresponds to their role. A teacher sees their students, a family sees their children, and a student only sees their own data.

Key measures

• Passwords: managed by Google Firebase’s identity system; not even we can see them. That is why, if you forget it, it must be reset and cannot be recovered.
• Role-based access: permissions are checked on the server, not just on the screen. A hidden button is not the only barrier: the request is rejected regardless.
• Encryption in transit for all communications.
• Payment data: we do not store it. It is managed directly by the payment gateway.
• Activity logs to detect and diagnose incidents, which are automatically deleted after 30 days.

For school accounts, student passwords are managed by the school itself from their panel: if a student forgets it, their teacher resets it.

A piece of advice: use a password that you do not reuse on other sites. It is the single measure that protects any account the most.