Security on 128ordle
Last updated: October 7, 2026.
This page explains, without jargon, how 128ordle protects accounts, payments, and scores, and where the limits are. No online service can promise perfect security, so it also covers what you can do yourself.
Connections
Every page is served over an encrypted HTTPS connection, and browsers are told to refuse an unencrypted one. The site also blocks being embedded inside other websites and restricts which outside scripts are allowed to run.
Accounts and passwords
Sign-in is handled by Supabase Auth, an established authentication service. Passwords are stored as salted hashes, not as readable text, and 128ordle's own records never hold your password.
Passwords must be at least eight characters. You can also use Continue with Google, in which case 128ordle never sees a password at all and receives only your basic profile: name, email address, and profile picture.
Changing your email or password requires you to be signed in, and changing your password asks for the current one first.
Payments
Checkout runs on pages hosted by Stripe. Your card number, expiry date, and security code go to Stripe and never pass through or get stored by 128ordle. The site keeps only what it needs to give you what you bought: the product, the payment status, and a reference to the Stripe transaction.
Unlocks are granted by the server after Stripe confirms the payment, not by anything your browser claims.
Your records
The database enforces access rules on every request. Private records such as your settings, purchases, and billing status can be read and changed only by your own signed-in account. Public information such as leaderboard entries and profile names is readable by everyone by design.
These rules are covered by automated tests that run against a scratch copy of the database, so a change that would expose private records is caught before release.
Scores and abuse
Submitted results are checked on the server, and guest submissions are rate limited. Suspicious results can be hidden or removed under the Fair Play Guidelines.
Party chat is filtered and kept as a moderation record so that reports of abuse can be reviewed.
What you can do
Use a password you do not use anywhere else. Sign out on shared or school devices. Do not put private details in a username or profile, because those are public.
128ordle will never ask for your password or card number by email. Do not send either to support.
If something goes wrong
If 128ordle learns of a security incident that affects your personal information, affected players will be told and the steps taken will be explained, in line with the law that applies.
If you find a vulnerability, please report it privately to [email protected] before sharing it anywhere else. Do not access other players' data or disrupt the service while testing. Good-faith reports are welcome and will get a reply.