Security

A short, honest summary of how we protect your data and your money.

Paper balances are not real funds

Ordinary subscriber and promo accounts receive a simulated $100,000 wallet. Tennis Magic AI does not request their Kalshi password or API key, does not connect their Kalshi account, and cannot send a real subscriber order.

Where your card information lives

Your full card number lives at Stripe. Stripe is a PCI-DSS Level 1 service provider. Card data enters Stripe's hosted iframe and never touches our servers. We see only the tokenised customer ID, the last-4 digits of the card, the subscription status, and dispute/refund events.

Ordinary accounts do not store Kalshi credentials

• No Kalshi setup appears in the ordinary signup or payment flow.
• Ordinary account API routes are blocked server-side, not merely hidden.
• Paper wallets, positions and history are stored separately per member.
• Paper orders cannot call the real-order transport.

Transport security

• TLS (HTTPS) on every page. HTTP traffic is redirected.
• HTTP-only same-site session cookies.
• No third-party analytics / advertising trackers on protected pages.

Account security

• Login uses a username + password tied to your Stripe-paid subscription.
• Auto-logout after inactivity.
• We will never ask you for your password by email, Telegram, or phone. If anyone does, it's a phishing attempt — report it via /contact.

What we deliberately do not store

• Your full card number (Stripe holds it).
• Your Kalshi password or API key for an ordinary subscriber account.
• Your bank account or routing numbers.
• Government ID / SSN / passport scans (we do not need them).

If we discover a breach

We will notify affected users without undue delay and as required by applicable law (GDPR/UK 72-hour rule for serious incidents). Notifications go to the email tied to your Stripe subscription. We will explain what happened, what we did, and what you should do next.

Reporting a security issue

If you have found a security issue, please send a private report through /contact with the topic "Security / privacy" and we will route it to the engineering team within one business day. Please do not disclose the issue publicly before we have responded. We treat responsible reporters well.

Full data handling is described in our Privacy Policy. Full legal terms are in our Terms of Use.