Your data is safe here.

Passwords are never stored

Your password is hashed with bcrypt before it ever touches our database — a one-way process that makes it mathematically infeasible to recover the original. Even our own engineers cannot see your password. We never store it in plain text, ever.

We never see your card number

All payments are processed through Stripe, the same platform used by Amazon, Shopify, and thousands of other trusted businesses. Your card details are entered directly on Stripe's PCI-DSS Level 1 certified infrastructure — they never pass through our servers. Range to Reef only receives a confirmation that payment was successful.

Encrypted in transit and at rest

All connections to Range to Reef are HTTPS-only with TLS 1.2+. Your data is stored on Neon PostgreSQL, a SOC 2 Type II certified cloud database hosted on Google Cloud Platform, with encryption at rest and regular automated backups.

JWT authentication — stateless and signed

Your session is managed with JSON Web Tokens (JWTs), signed with a secret key using industry-standard RS256 encryption. Tokens expire automatically and are verified on every request. We also use short-lived refresh token rotation to minimize exposure if a token is ever compromised.

Rate limiting and brute-force protection

Login and registration endpoints are rate-limited. Repeated failed login attempts are blocked automatically. We log and monitor unusual traffic patterns to detect abuse early.

We do not sell your data

Range to Reef does not sell, rent, or trade your personal information to third parties — ever. We use your email to send you transactional messages (receipts, alerts you set up, password resets) and, if you opt in, our newsletter. That is the full extent of how we use your contact info.

What we collect and why

We collect your email, name (optional), and membership status to run your account. We log which products you view to power features like Recently Viewed. We collect aggregate analytics to improve the platform. We do not collect your browsing history outside of our site or build advertising profiles.

Account deletion

You can delete your account at any time from your dashboard. Deletion permanently removes your profile, watchlists, gear requests, and personal data from our systems within 30 days. Anonymized usage data (e.g., aggregate click counts) may be retained for analytics.