Account Security

Your SignalP account holds your journal, your trade grades, and the analytics that surface your anchor trade. That's months of work sitting behind one login. This page covers how you get in, what you control, and what we do on our side.

How you sign in

There are two ways into SignalP:

• Email and password — the account you created at signup.
• Continue with Discord — signs you in through Discord, so there's no second password to remember.

New accounts confirm their email address before the first sign-in. We don't offer Google, magic-link, or one-time-code sign-in.

Your password

• Change it from Settings. If you've been signed in a while we'll ask you to reauthenticate first — that's deliberate, so a walked-away laptop can't be used to lock you out of your own account.
• Forgot it? Request a reset from the password reset page. The link arrives by email and takes you to a page where you set a new one.

SignalP requires a minimum of eight characters. Treat that as a floor, not a recommendation. What actually protects you:

1. Use a password manager, and a password you use nowhere else. Reused passwords are how most accounts get taken over — not by someone cracking SignalP, but by someone replaying a password leaked from an unrelated site years ago.
2. Protect the email address on the account. Anyone who can read your inbox can reset your SignalP password. Your email account deserves stronger protection than your trading account, because it's the key to both.
3. Don't stay signed in on shared machines. Signing out ends the session on that browser only.

Your email address

Change it in Settings. The change is confirmed at both addresses, old and new — so someone who reaches your session still can't quietly move the account to an inbox they control.

Your Discord link

Linking Discord from Settings grants the community channels your plan includes, and keeps your Discord role in sync with your subscription. Unlink at any time from the same page. Unlinking removes community access; it doesn't touch your SignalP account.

What we do on our side

• Row-level security on every user table. Access control lives in the database itself, not only in application code. Your signals, journal notes, trading profile, Quicksheet plans, and points ledger are each governed by policies that check who's asking before a single row comes back — close to two hundred such policies are in force.
• Everything over HTTPS. Traffic between your browser and SignalP is encrypted in transit.
• CSRF protection on every request that changes data, so another site can't act on SignalP in your name while you're signed in.
• Managed Postgres. The database runs on Supabase, with their infrastructure-level encryption and backups.

Payments

Card details never reach SignalP's servers. Checkout runs inside Stripe's embedded form — your card number goes from your browser to Stripe directly. What we store is a Stripe customer ID and a subscription ID: enough to know which plan you're on, and nothing that could be used to charge a card.

Updating a card, downloading invoices, and canceling all happen in Stripe's billing portal, reached from your billing settings.

What we don't offer yet

Being straight about the gaps is what makes the rest of this page worth trusting.

• No two-factor authentication. SignalP doesn't support authenticator apps or SMS codes on member accounts yet. Until it does, the strength of your password and the security of your email inbox are what stand between an attacker and your account — which is why both are worth doing properly.
• No session or device list. You can't see where else you're signed in, and signing out ends only the current browser's session. If you suspect someone else has access, change your SignalP password — and your email password too.
• No self-serve login history. We don't currently surface a record of sign-ins for you to review.

Your data

We don't sell your personal information. The Privacy Policy is the authoritative statement of what we collect, which providers process it on our behalf, and how long we keep it.

You can delete your account from Settings. Deletion is confirmed by a one-time code sent to your email, and signs you out when it completes. If you have an active paid subscription, cancel it first — deletion is blocked until you do. It isn't reversible from your side, so if you want to keep your journal or your trade history, save it before you start.

If something looks wrong

An unexpected sign-in notice, a signal you don't recognize, a billing change you didn't make — tell us. Change your password first, then open Support and include when you noticed it. That detail helps more than you'd expect.