Security Policy

1. Our official channels

• Websites: factual.money, app.factual.money, learn.factual.money and letters.factual.money.
• Email: addresses ending in @factual.money, such as support@factual.money and info@factual.money.
• Anything else using our name, logo or team members' names should be treated as suspicious.

2. Payments

• App subscriptions are paid only through our payment processor's secure checkout opened from app.factual.money. Courses and merchandise are paid only through the checkout on learn.factual.money.
• We never ask for payment by message, social media, WhatsApp, bank transfer, PIX or cryptocurrency.
• We never ask for your password, card number or verification codes.

3. Investments and endorsements

We do not offer, manage or endorse investment products, managed accounts, trading signals, groups or political candidates. Anyone offering these in our name is not factual.money.

4. How we protect your data

• All connections use encryption in transit (HTTPS).
• Passwords are stored only as secure hashes by our authentication provider.
• Row-level security in our database ensures each account can access only its own questions, notes, watchlist and briefings.
• Card details are handled by our payment processors and never stored by us.
• Server keys are kept in protected environment variables and are never exposed in the browser.

5. Protect your account

Use a strong, unique password, keep your email account secure, and sign out on shared devices. If you suspect someone has accessed your account, reset your password and tell us.

6. Report a problem

To report a suspicious message, a website imitating us, or a security vulnerability, write to support@factual.money. If you report a vulnerability in good faith, without accessing other users' data or disrupting the Services, we will work with you to fix it and will not take action against you.