Security information

MMHVAULT is a personal finance application, not a bank or payment service. It does not require bank PINs, card numbers, crypto seed phrases or exchange passwords.

Authentication

Email/password and Google OAuth are processed through the configured Supabase Auth service over HTTPS. Phone OTP sign-in is no longer offered by MMHVAULT. Google OAuth redirects to Google's sign-in flow; MMHVAULT does not collect a Google account password.

Account isolation

Personal data is scoped to the authenticated account. Notification subscriptions and financial alerts use user-scoped access controls. The local AI assistant is read-only and does not directly modify financial records.

Background notifications

Web Push is optional. The dedicated Push service worker handles only push and notification-click events and does not cache the application or intercept page requests.

If something looks wrong

Do not bypass browser security warnings or enter credentials while a browser reports the site as unsafe. Return to the main page and verify the exact hostname before signing in.