Security & Privacy Practices

Reasonable security practices

• All traffic served over HTTPS with HSTS.
• Authentication and account data managed by a vetted identity provider with secure password hashing.
• Database access protected by row-level security and least-privilege service keys.
• Secrets stored in a managed secret store, never in source control.
• Routine dependency scanning, security review of high-severity advisories, and prompt patching.

Privacy by design

Generator sessions execute primarily in your browser. Inputs and outputs are not transmitted to our servers unless you explicitly save them. Analytics are aggregated and minimised; we do not build cross-site advertising profiles.

Incident response

Material security incidents are investigated, contained, and disclosed to affected users in accordance with applicable law. Researchers acting in good faith may report vulnerabilities to security@namegeneratortools.com and will not be pursued.