Account, notifications, and security

Login and role routing

Email login stores a local session token and normalized user object in the browser. Role routing sends users to the matching dashboard. Logout clears the local session in supported surfaces.

Password recovery and social login

Forgot password and OAuth provider buttons currently communicate readiness and configuration requirements. They should be connected to production provider settings before being advertised as fully operational recovery or social login paths.

Notifications

1. 1Open the mobile Notifications tab after signing in.
2. 2Review marketplace, commerce, creator, affiliate, and admin alerts in the feed.
3. 3Toggle push categories such as commerce alerts, creator alerts, affiliate alerts, and admin alerts.
4. 4Use Mark read or tap individual alerts to clear unread status.

Trust and privacy expectations

• ✦ Public APIs avoid exposing secrets, private file paths, payment keys, admin notes, and private contact details.
• ✦ Paid downloads use entitlement checks, temporary signed links, limits, and file safety status.
• ✦ Sensitive admin actions are represented in audit logs for accountability.

Support account safety

Support tickets can be created as a guest or signed-in user. Signed-in users can view ticket history and replies; guest tickets are acknowledged without exposing private account history. Support should never ask users to paste passwords, private keys, payment card numbers, webhook secrets, or admin credentials into tickets.