Holiday Tracker holds real names, emails, and shared cost/payment records for groups of travellers. Here's what actually protects that data — not a generic statement, the real practices this app runs on.
Passwords are hashed (never stored in plain text) using ASP.NET Core Identity's built-in hashing. Repeated failed logins lock an account out temporarily rather than allowing unlimited guessing.
You only ever see holidays you own or have been explicitly invited to. There's no directory of other users, and holiday owners can't browse or search for anyone outside the people already on their own holiday.
Invite links use a randomly generated 256-bit token — not a guessable sequence — and expire automatically. Revoking one immediately stops it from working.
The site is served entirely over HTTPS, and the login session cookie is locked to secure connections only.
You can request full account deletion at any time from My Account — it's reviewed and processed rather than instantly wiping shared holiday data other people are still relying on.
Found a security issue? Please let us know rather than posting it publicly.