Security

"Bank-level security" doesn't mean anything on its own. Here's exactly what protects your money and your information when you use Pot No Luck, and who's actually responsible for each piece.

Your card and bank details never touch our servers

When you pay a buy-in or set up where your winnings go, that information goes directly to Stripe, not to us. Stripe is the same payment processor used by companies like Amazon, Shopify, and millions of other businesses. We never see, store, or have access to your full card number, bank account number, or routing number. What we keep on our end is limited to transaction amounts, dates, and Stripe's own reference IDs, enough to track who's paid and who's owed money, nothing more.

Your password is never stored in readable form

We hash every password with bcrypt before it's saved, a one-way process that means even if our database were somehow accessed, your actual password wouldn't be readable from it. We can't see your password, and we never ask for it outside the app itself.

Everything is encrypted in transit

Every connection between the app, this website, and our servers uses HTTPS. Your data is encrypted the entire way there, not just partway.

Identity verification for payouts

Before Stripe will send money to a linked bank account, it verifies the identity of whoever's receiving it. This isn't a Pot No Luck decision, it's a legal requirement (called KYC, "Know Your Customer") that applies to anyone moving money this way. It's the same reason opening a real bank account asks for your details, and it's there to protect against fraud on everyone's behalf.

What we're honest about not having yet

We're a small, early-stage app, and we'd rather tell you what's still ahead than overstate where we are. We haven't yet completed a third-party security audit, and two-factor authentication for your account isn't built yet. Both are on our list as this grows. If you ever have a security question or concern, we'd genuinely like to hear it directly rather than have you guess.

Questions or concerns

Reach out anytime at potnoluck@gmail.com, including if you think you've found a security issue. We'll take it seriously.