Security & Privacy

Bright delegates credential handling and sessions to managed Neon Auth. The Bright application database stores the member identity link and email needed to operate the community, not a second copy of the account password.

Protected pages require an authenticated member. Sensitive actions reload current account status, role, and scope from the database. Rank, Level, and profile titles do not grant software authority.

Direct-message reads require conversation participation. General Chat is intentionally shared with active members. Bidirectional blocks separate people across profiles, discovery, following, direct messages, posts, comments, and reactions.

Photo and GIF uploads are purpose-bound, size-limited, structurally inspected on the server, and finalized against the authenticated owner. Bright also uses restrictive response headers, rate limits, narrow server validation, and audited privileged actions.

Bright uses Neon Postgres for application data and maintains database backup and restore evidence. Precise GPS and exact addresses are not part of the current member profile model.

Deletion requests now deactivate access and enter an audited operator-reviewed removal path. Verified email delivery, final deletion timelines, provider MFA evidence, separate Preview resources, and narrower database roles remain active Gate II work. Bright will not describe those controls as complete before they are proven.

Use the contact on this page for a suspected security issue, privacy request, or safety concern. Do not include passwords, session cookies, or private credentials in the report.