The interface tells the truth about what the software guarantees.
Every claim on this page points at a mechanism in the database or the code, not at a policy document.
Tables the application itself cannot rewrite.
Transactions, points, the audit log and settlements are INSERT and SELECT only — never edited, never erased. Invoices, payouts and the blacklist journal cannot be deleted. Not even the back office is exempt: every app connects as the same restricted database role, a correction is written as a new entry, and the wrong one stays visible.
One center cannot read another's rows.
Enforced by row-level security policies inside PostgreSQL itself, not by an if-statement in application code. A query that forgets its filter returns nothing rather than everything.
Minor is the default, everywhere it matters.
One positive condition decides adulthood: a date of birth that exists, is verified, and puts them at 18 or over. A missing field or an unverified date can never silently unlock a child's account — and adult-facing messaging stays locked until a guardian channel is confirmed, without stopping a single lesson, payment or sign-in.
Deactivation ends a session in the same statement.
A database trigger deletes a user's sessions the moment their status changes or their account is removed — so it holds even for statements that never went through the application. And changing a password ends old sessions on every device.
IDs only, and minors are never identified at all.
No name, email, phone or anything a human typed reaches an analytics vendor. Session replay and autocapture are off, and single-use tokens are redacted before an error ever leaves the browser.
Read the real thing.
These mechanisms are what the policies describe — and the policies themselves are here.