Security

Your account

• Passwords are stored only as Argon2id hashes and checked against known leaks.
• Two-step verification with any authenticator app, with one-time recovery codes.
• Login attempts are rate-limited and you can see and close your active sessions.
• We email you when your password, email or two-step settings change.

Your data

• Encrypted connections everywhere (HTTPS with HSTS) and a strict content security policy.
• Servers and database in the EU (Frankfurt), with encrypted connections between them.
• We never see your card: payments are handled by Stripe.
• You can download or delete all your data from Account at any time.

Report a vulnerability

If you find a security issue, please email support@betthedrop.com with the details and don't share it publicly until we've fixed it. We reply quickly and credit responsible reports. See also /.well-known/security.txt.

Last updated: 13 October 2026