Privacy & Security

Sign-in is handled by Firebase Authentication (email/password or Google Sign-In). We never see or store your password — Firebase handles credential verification, and for Google Sign-In, your Google password is never shared with us at all.

Every server-side action that reads or writes personal data verifies the caller's identity from a signed Firebase ID token — never a value the browser is trusted to self-report. Firestore Security Rules additionally restrict direct database reads so a signed-in user can only read their own profile, orders, reports, and meetings; a real cross-user isolation test (one user attempting to access another user's report/PDF) was run against this system and confirmed to correctly deny access.

Payments are processed by Cashfree Payments. Your card, UPI, or net-banking credentials are entered directly on Cashfree's own secure checkout and are never transmitted to or stored by TrueLoger. We store only the payment reference and status Cashfree reports back to us. We do not claim PCI-DSS certification for TrueLoger itself — that responsibility sits with Cashfree as the payment processor.

Generated report PDFs and astrologer-application resumes are stored in private cloud storage — neither is ever given a public URL. A report PDF is only ever served to its owning user (verified by server-side ownership check) or an admin; a resume is only ever accessible to an authenticated admin via a dedicated, access-controlled route.

All traffic to and from the site is served over HTTPS/TLS. Data at rest in our database and file storage is encrypted using our infrastructure providers' (Google Firebase) standard encryption-at-rest.

Administrative access is granted only via a server-controlled Firebase custom claim, never a client-editable flag — a normal user account cannot make itself an admin by any action available in the app. Admin actions (editing prices, viewing orders, reviewing applications) are themselves re-verified server-side on every request.

If we become aware of a security incident affecting your personal data, we will take reasonable steps to contain it and notify affected users and, where legally required, the relevant authority (India's CERT-In publishes directions relevant to incident reporting for covered entities). We do not publish internal infrastructure details, logs, or specific controls that could assist an attacker.

We do not claim TrueLoger is "100% secure," unhackable, or holds any certification (ISO, SOC 2, PCI-DSS, or otherwise) that has not actually been obtained. Security is an ongoing practice, not a one-time guarantee.