One Grind, Every Device
Sign in and your solves, streak, and badges follow you everywhere. Everything below is live — the account panel talks to the real backend, and the grind mirror shows this exact browser.
// sign in
Wrong password? Same vibe as wrong attack — try again. Locked out = privacy working as intended.
// create account
Salted PBKDF2 hashes, never stored raw. No recovery yet — keep that password loud.
// session — root
cloud: —
Push overwrites cloud with this browser. Pull overwrites this browser with cloud (asks first, explains both sides). Nothing merges silently — you're the merge.
// your profile — this browser
The grind, mirrored
Live from the same pipe the dashboard uses — level, streak, and every badge you've earned on this browser. Sign in and push it to cloud so the mirror follows you everywhere.
// receipts
What your data is doing
- > Progress follows you across devices — solved, streak, badges, all of it.
- > Passwords stored as PBKDF2-HMAC-SHA256 hashes, timing-equalized login, per-IP rate limits.
- > Sessions are 30-day HttpOnly Secure cookies; logout revokes server-side.
- > Your saves are yours — push and pull are explicit, nothing merges silently.
- > This interim store is D1 (SQLite); the production platform is tenant-isolated Postgres behind RLS with MFA, signed solve receipts, and breach-checked passwords. See SECURITY.md.
- > Solves honored server-side with signed receipts — the leaderboard stops trusting your browser.