Public pages do not need an account. There is no registration.

The contact form stores a name, an email address, and a message. Only invited admins can read them.

A person using the dashboard gets a session cookie. It is HttpOnly, Secure in production, SameSite Lax, and it lasts twelve hours. It is host-only.

These marketing pages do not load an analytics script. Media uploaded by admins stays on the server. A postal address is not published.