Trust & Security

• Email and password sign-in plus Google sign-in, handled by a managed authentication service. Passwords are salted and hashed — we never see them.
• Leaked-password screening and email verification on sign-up.
• Adults only: every account confirms it is 18+ at registration, and accounts found to belong to minors are removed.
• Roles are stored server-side in a dedicated table. Admin capabilities are never granted from the browser or from client storage.

• Row-level security is enabled on every application table, so a signed-in user can only read and write the rows they are entitled to.
• Membership, pricing and entitlement checks run on the server. Client-supplied prices, coin amounts and roles are never trusted.
• Coin spending and gifting run as atomic database transactions, so balances cannot be double-spent.
• Encryption in transit (TLS) everywhere, and encryption at rest at our hosting provider.

• Paid and private media lives in a private storage bucket that is not publicly addressable.
• Access is granted through short-lived signed links issued only after your entitlement is checked server-side.
• Captions may be visible before you join a Friends List; the media itself is not.
• Deleting media removes it from the app; encrypted backups are rotated out within 30 days.

• Card details are entered directly into Stripe's PCI-DSS compliant checkout. No card number, CVC or bank credential ever reaches our servers or database.
• Purchase confirmations arrive through signature-verified webhooks and are processed exactly once, so you are never credited or charged twice.
• Prices are resolved server-side from our catalogue, so a purchase cannot be tampered with in the browser.
• Card statements show RIZZLA CHAT, and every charge is receipted by email. See our Billing Terms.

• In-app reporting on profiles, chats and rooms, with prioritised handling for child-safety and non-consensual imagery reports.
• Role-restricted admin review of reported content, used for safety and dispute investigation.
• Soft delete with a 7-day restore window, so mistaken removals can be reversed.
• Rules and enforcement steps are published in our Acceptable Use & Content Policy.

Our hosting, authentication, storage and payment providers secure the underlying infrastructure. KOLO TECHNOLOGY LLC is responsible for the application's access rules, moderation and data handling. You are responsible for keeping your password private, only uploading content you have the right to share, and reporting anything that looks wrong.

Email rizzchatsupport@gmail.com with the subject SECURITY. Please give us reasonable time to fix an issue before disclosing it, and do not access other users' data while testing. We acknowledge reports within 48 hours.