Privacy

An account can be a guest or an email login. Passwords are stored as hashes. Access tokens are short-lived JWTs, and only a hash of the refresh token is kept. Images live in the object storage you configure. Development defaults to the local disk. The API returns error codes rather than translated sentences, and the interface language is chosen by the client. WeChat and other OAuth logins will arrive as additional identity providers on the same user, not as a second account system.