Security

The only way into the dashboard is your Google sign-in; MarketGain stores no passwords. Sessions ride on httpOnly cookies managed by our auth provider, so tokens are never exposed to page scripts.

The Notion connection is read-only and scoped to exactly the pages and databases you share. MarketGain never writes to Notion. The synced copies are deleted 30 days after you disconnect Notion, and straight away when you delete a knowledge base or workspace.

Every table carries row-level security scoped to the workspace, browsers never talk to the database directly, and every dashboard request re-checks your membership before it touches a row. One workspace's content is not reachable from another's, not even through the API.

Everything is served over HTTPS with HSTS and clickjacking protection, and the public chat endpoints are rate-limited per visitor IP before any request reaches your plan's quota.

Visitors are identified by a random id, not a profile: MarketGain does not track page views or browsing. Conversations are stored only when the site's privacy setting allows it, and are deleted after 400 days of inactivity.

Supabase (database, sign-in), Cloudflare (hosting, delivery, abuse protection, Workers AI), DeepSeek (answer generation), Google (sign-in) and Notion (reading your shared pages). What each one receives is listed in the Privacy Policy.

Workspace owners can delete a workspace in Settings → General; account deletion lives in the account menu. Anything else: support@marketgain.space.