Security

Last updated: 30 October 2026

Your phone number, your club details and your bookings matter. Here is how we protect them, and how you can help.

What we do

• Encrypted connection. The site is served over HTTPS only. Plain HTTP requests are redirected, and browsers are told to always use HTTPS.
• Passwords are hashed. We store passwords with a salted, memory-hard hash (scrypt), never as plain text.
• Locked-down pages. A strict content security policy limits what scripts and connections the site can use, and the site cannot be embedded in other websites.
• Private data stays private. Account and booking responses are marked so browsers and proxies do not cache them.
• Abuse limits. Sign-in, sign-up and password reset attempts are rate limited to slow down guessing.
• Session control. Sign-ins expire automatically, and you can end every other login from your account.

What you can do

• Use a long, unique password, and set one if your account does not have one yet.
• Save your recovery code somewhere safe. It is how you get back in if you forget your password.
• If you used a shared or public device, open My Profile → Account security and choose Log out from all other devices.
• We will never ask for your password or recovery code. Do not share them with anyone.
• Check Recent security activity in your profile for sign-ins you do not recognise.

Reporting a security problem

If you find a vulnerability or think your account has been misused, please tell us through the contact details on mypandal.com. Include what you found and how to reproduce it. Please do not access other people’s data or disrupt the service while testing.