Tarc's security model leans on well-established providers for the hardest parts (authentication, data storage) rather than building custom, harder-to-audit systems.
Tarc never asks you to create a password. Google sign-in is handled entirely by Google; email sign-in uses one-time codes and magic links verified through Tarc's backend (Supabase) — there's no password field or password database to compromise.
All data sent between your device and Tarc's servers is encrypted in transit (HTTPS/TLS) — nothing is transmitted over an unencrypted connection.
Account data, progress, and uploaded avatars are stored via Supabase, which handles authentication and database access under Tarc's direction — Supabase doesn't use your data for its own independent purposes.
See Account Deletion — deletion runs as a single, transactional server-side operation, so it can't partially complete and leave orphaned data behind.
The public profile toggle controls what other users can see about you; sign-out on any device returns it to Guest Mode without affecting your account's stored data.
No — Tarc has no password field at all. Google sign-in is handled by Google directly, and email sign-in uses one-time codes/magic links instead of a password.
Yes — all data between your device and Tarc's servers is encrypted in transit via HTTPS/TLS.
It can't partially complete — deletion runs as a single transactional database operation, so either everything is deleted or (on error) nothing is, with no orphaned data left behind.