Security overview

Predct demo accounts are created and stored entirely in your browser under the local storage keys predct.accounts.v2, predct.session.v2, predct.slip.v2 and the cookie-consent key. There is no server-side user record and no session token. Your password is never transmitted: it is hashed with a random salt using SHA-256 and compared locally, so it separates profiles on one device rather than authenticating you to a service.

The practical consequence is that anyone able to edit local storage on your unlocked device can change your virtual balance directly, regardless of the password. Since credits have no value, this is a deliberate trade-off in favour of collecting nothing about you. Signing out ends the session only — your balance and full position history stay on the device until you delete the account yourself.

Page and asset requests to our hosting provider, and the web-font request to Google Fonts. Your email address, username, country, balance, slip and position history are never transmitted to us. We run no advertising or analytics profiling.

The site is served over HTTPS by our hosting provider, which terminates TLS and applies standard platform protections. Application code is static and rendered per request; there is no application database holding user data.

• Lock your device and use a browser profile only you can access.
• Export your account from settings before clearing site data.
• Treat any site or message offering to sell, top up or buy Predct credits as a scam — we never do this.
• We will never ask you for a password, a payment, a wallet key or a seed phrase.

Email security@predct.app with steps to reproduce, the affected URL and your assessment of impact. Please report privately, give us reasonable time to fix the issue before publishing, do not access data that is not yours, and do not run denial-of-service or social-engineering tests. Good-faith research within those rules will not be pursued, and we will credit you if you want.