How OYRB protects your business.

Client payments are made on each pro's own Stripe account. When a client pays a deposit, a balance or a gift card, Stripe processes the charge for that pro directly. OYRB does not hold the money, release it or take a fee from it.

• Clients enter card details on Stripe's secure checkout page. OYRB never receives or stores card numbers.
• Payouts go from Stripe to the bank account the pro linked in Stripe. OYRB does not store bank details.
• Refunds are issued by the pro from their own Stripe dashboard.

Accounts are managed by Supabase Auth. Pros sign in with an email and password or with Google. Passwords are handled by Supabase and are not stored in OYRB's own tables. Clients who want to see their bookings sign in with a link sent to their email, so they never need a password at all.

Business data lives in a Postgres database run by Supabase. Row level security is turned on for the main business tables, including bookings, clients and services, so the database itself limits which rows a signed-in account can read.

A small number of OYRB staff can see account information when they need to, for example to answer a support request, resolve a booking dispute or review flagged content.

Links in booking emails, such as the link to view or reschedule an appointment, contain a long random code that cannot be guessed. The links expire after a set time.

OYRB receives automatic updates from Stripe, Resend (email) and Twilio (text messages). Each update is checked for a valid signature from the sender before it is trusted, and unsigned requests are rejected.

• Sign-in codes, public search, reports and the contact form are rate limited. If the limiter is unavailable, those requests are refused rather than allowed through.
• Photo uploads from clients only accept image files up to 10 MB.
• Text messages go only to people who agreed to receive them, and replying STOP unsubscribes them.

The site is served over HTTPS only, and browsers are told to always use HTTPS. Other sites cannot load OYRB pages inside a frame, and the site does not ask for camera or microphone access.

If you think you have found a security problem, email support@oyrb.space with "Security" in the subject. Please include steps to reproduce it and do not access other people's data while testing.

For how we collect and use personal information, see our Privacy Policy.