Trust & Security Center

DS Colony · Last updated 1 October 2026

Trust is an engineering property here, not a badge. This page describes what the platform actually does — nothing more.

Security posture

DS Colony is built with defense-in-depth and least privilege. No honest service can promise that security incidents are impossible, and we do not make that promise. What we do commit to:

Secure authentication — passwords are stored only as scrypt hashes, login is timing-equalized, and accounts lock temporarily after repeated failed attempts.
Encrypted transport — all traffic to DS Colony runs over HTTPS (HSTS enforced).
Least-privilege access — every API route checks who you are and what you own server-side; admin and moderation actions are role-gated and logged.
Hardened execution — practice code runs in an isolated sandbox with no database access, no production secrets, and strict resource limits.
Verified releases — every production deploy passes automated type-checks, a full test suite, a build gate, and a post-deploy health check before it serves you.
Encrypted backups — the database is backed up on a schedule with encrypted, access-controlled artifacts.

Privacy, in short

We collect what the product needs and nothing more: your account details, your learning progress, your own projects and research, your messages, and the content you post. No third-party trackers, no advertising pixels, no behavioral profiling. Nothing about you is public unless you turn a public toggle on — and those toggles are off by default. Full detail: Privacy Policy.

Your data, your control

Delete your account — self-serve, any time: Settings → Delete account on the web, or Settings → Delete account inside the Android app. Your account, learning history, sessions, messages and community activity are removed; community posts remain but display as an anonymous member. Deletion is immediate and irreversible.
Consent toggles — public portfolio and recruiter discoverability are separate switches, off by default, and reversible instantly.
Correction — your name, goal, profile fields and interests are editable in Settings at any time.
Access & questions — contact [email protected] for anything about your data, including export questions.

Community safety

Community content is moderated by humans, not algorithms. Every report lands in a human review queue with a 24-hour internal target; reports are free to file, reporter identity is never revealed to the reported user, and the enforcement ladder (dismiss → hide → warn → suspend) is published. Rules and boundaries: Community Guidelines and Moderation & Reporting.

Responsible disclosure

If you believe you have found a security vulnerability in DS Colony, please report it privately to [email protected] (Ankush Jha). Include reproduction steps and affected URLs. Please do not test against other users' accounts, do not access or modify data that is not yours, and avoid automated bulk scanning. We acknowledge reports in good faith and aim to respond within a few business days. We do not operate a bug bounty program.

Processors and subprocessors

DS Colony is built on a small set of infrastructure providers, each processing data only to deliver the service:

Supabase — managed PostgreSQL database storage (user and learning data).
Railway — application hosting and deployment.
Cloudflare — DNS and edge/TLS in front of the application.
Resend — transactional email (verification codes, password resets). Only necessary account emails; no marketing.
Google — Google Sign-In (email and name via OAuth, only if you use it).
GitHub — source control, CI/CD and encrypted backup storage.

We do not sell, rent, or share personal data with advertisers or data brokers, ever. AI features, when activated, will be disclosed here with their provider and data practices before they process anything.

Status and availability

DS Colony is in closed beta and is monitored continuously — an automated health probe checks the production service every hour and the deployment pipeline gates every release. We do not warrant uninterrupted availability during beta; incidents affecting accounts or data will be communicated to affected users honestly.

Reporting other problems

Content and conduct issues: the in-product report button or the moderation page. Copyright complaints: the copyright policy. Everything else (including grievances about how your data was handled): [email protected] — acknowledged within 24 hours, targeted for resolution within 15 days.