Security

• Passwords are hashed with bcrypt; we never store or see them in plain text.
• Sign-in sessions use long random tokens, stored only in hashed form, in secure httpOnly cookies. Resetting your password signs you out everywhere.
• Google sign-in uses the OAuth 2.0 standard with PKCE and state checks.
• Payments run on Razorpay. ARTON never handles card numbers or UPI PINs, and every payment is confirmed by verifying Razorpay's cryptographic signature on our server.
• Uploads are decoded and re-encoded to block malicious files, and photo location data is removed.
• Commissions, messages and reference images are visible only to the two people involved.
• Sign-in, uploads, messages and payments are rate-limited to stop abuse.

• Use a unique password, or sign in with Google.
• ARTON will never ask for your password, OTP or UPI PIN by message or email.
• Pay for commissions only through ARTON, never by direct transfer to someone you met here.

If you find a security issue, please report it privately through the contact page with the topic “Security issue”. Include steps to reproduce it. Please don't access other people's data, disrupt the service, or share the issue publicly before we fix it. We'll acknowledge your report and keep you updated.

• Email: athuwankhade912@gmail.com
• Or use the contact form.