Security and privacy

Account protection

• Passwords are never stored in plain text. Only a hash computed with scrypt is kept, from which the original password cannot be recovered. No member of the Weblym team can access it.
• Verification codes sent by email are also stored hashed, expire after one hour and can only be used once.
• Session control: you can see every active session and close any you do not recognise. Changing your password automatically closes all the others.

Data handling

• All communications travel encrypted over HTTPS.
• No cookies and no tracking tools, our own or third-party. Visits to this site are only counted if you accept it, and only as daily totals, with no data that could identify anyone. More information in the cookie policy.
• No advertising and no selling of data.
• You can delete your account at any time; your stores, pages, products and images are deleted with it.

The details of the data we process and how long we keep it are in the privacy policy.

Isolation between accounts

The browser never accesses the database directly: only our server holds credentials, and the database rejects any other access.

The ownership of each store by its account does not depend solely on the server’s checks: it is enforced by the database itself. No page and no product can ever be saved into another account’s store. And when asked about a resource that belongs to someone else, the platform responds exactly as if it did not exist.

Abuse prevention

• Usage limits on sign-in, account creation, email sending and saving, designed to stop automated use without affecting people.
• Our own verification on sign-up and contact forms, solved entirely in your browser and without third-party services that track you. For suspicious connections, the challenge gets harder.

Published stores

• Published stores can only run the platform’s code: any other script is blocked.
• Customer accounts belong to each store and are kept separate from Weblym accounts and from those of any other store.
• Once payments are live, card details will be handled by the payment provider and will never pass through our servers.
• The upcoming AI-generated custom components will run in an isolated environment, only after passing automated verification, and will access only the data they declare, never customer sessions or personal data.

Responsible disclosure

If you find a vulnerability, please report it to [email protected] before making it public. We will reply and keep you informed throughout the fix.