Security

Written in English. Ask us on WhatsApp and we will explain any clause in your language.

The short version

This site is a set of static pages served over HTTPS. It has no user accounts database of its own, it loads no advertising scripts, and it never sees a card number. The pieces that do hold data — sign-in, request history and payments — sit with established providers, and the only code we run on a server is a small relay for the chat assistant.

We would rather tell you plainly how it is built than dress it up. Everything below is what actually runs today.

How the site is served

The pages are published from a private repository on GitHub Pages and delivered over HTTPS at brownhub283.com. There is no content management system, no plugins and no server-side form to patch, which removes most of the attack surface a normal website carries.

Because the pages are static, anything you type into them goes only where this page tells you it goes. There is no hidden analytics pipeline.

Accounts and signing in

The optional “My requests” area is handled by Supabase. Passwords are salted and hashed by that provider and are never stored in readable form by BrownHub; we cannot see yours, and no one writing to us can reset it without going through the same sign-in flow you use.

A confirmed phone number adds a one-time code by text message as a second step. The code is delivered by our SMS provider and expires on its own.

BrownHub staff will never ask for your password or for a code sent to your phone. If anyone claims to be us and asks, do not send it. Report it instead, at the address further down this page.

Payments

Checkout runs in Paystack's hosted window. Paystack holds the card and mobile money credentials; BrownHub receives only the item, the amount and a reference. Card details therefore never reach this website, our code or our mailbox.

Prices are shown in Ghana cedis and are confirmed in your quote before payment is requested.

Forms, spam and abuse

The contact form and the voice-note uploads are relayed to our mailbox by FormSubmit. They carry a hidden field that a human never fills in and a short minimum time before a send is accepted, both of which stop the great majority of automated submissions without affecting you.

Submissions that trip those checks are dropped silently; the sender still sees a confirmation, so a bot gets no signal about what stopped it.

The upload fields accept audio files of a bounded size and type. Nothing you send there is published anywhere on the site.

The chat assistant

The assistant in the corner answers from a written fact sheet about this studio. Your message travels to a single server-side function, which forwards it to the model and returns the answer. The key for that model lives in the function's configuration on the server, never in the browser, and the function refuses requests that arrive from any site other than this one.

It is still a third-party AI service. Ask it about prices, lead times and what we do; do not type an address book, a password or anything you would not send in an email.

What this site keeps on your device

Your chosen language, the dark or light theme, the state of your sign-in session, and your cookie choice. That is the whole list, and you can inspect or clear it in your browser at any time.

The Cookie preferences window records what is allowed. Accepting or rejecting changes only what is stored in your own browser, and rejecting non-essential categories does not remove any part of the site.

What we never store

Card numbers, PINs, CVV codes, bank passwords, online-banking credentials, account passwords in readable form, or one-time codes. Not in a database, not in an email, not in a chat log.

Third parties involved

GitHub Pages serves the pages. Supabase provides sign-in and request history. Paystack processes payments. FormSubmit relays the contact form and the voice notes. An SMS provider delivers verification codes. A large-language-model provider answers the chat assistant through our own relay. Each of them is bound by its own privacy policy and terms, and this page names them so that nothing is passed off as happening “in the cloud”.

Reporting a security problem

If you find a weakness on this site, or you believe a BrownHub account or a message from us is not what it claims to be, write to howelldaniel533@gmail.com with the word security in the subject line. Please send it to us directly rather than posting it publicly, so there is time to fix it first.

You can also reach the studio on WhatsApp at +233 50 295 4543, or read how personal details are handled in the privacy policy and the working terms on the legal page.