Security

Ask us on WhatsApp and we will explain any clause in your language.

The short version

This site is a set of static pages served over HTTPS. It has no user accounts database of its own, it loads no advertising script until you say yes in the cookie preferences, and it never sees a card number. The pieces that do hold data — sign-in, request history and payments — sit with established providers, and the only code we run on a server is a small relay for the chat assistant.

We would rather tell you plainly how it is built than dress it up. Everything below is what actually runs today.

How the site is served

The pages are published from a private repository on GitHub Pages and delivered over HTTPS at brownhub283.com. There is no content management system, no plugins and no server-side form to patch, which removes most of the attack surface a normal website carries.

Because the pages are static, anything you type into them goes only where this page tells you it goes. There is no hidden analytics pipeline.

What the browser is told to allow

Every page carries a content security policy: a written list, shipped inside the document itself, of the code and services a browser may load here. Only BrownHub's own scripts run. The one outside script permitted is Paystack's checkout, and the site will only send data to the payment, form-relay and account services named on this page — so a page that has been tricked into asking for something else is refused by your browser before the request ever leaves.

Pages also refuse to be placed inside a frame on another website, which is how a look-alike page gets a visitor to type a password into someone else's form. Alongside that, browsers are told not to hand full page addresses to third parties, and this site's pages give up the right to reach the camera, location, screen capture, USB and Bluetooth ports and the motion sensors — none of which a design studio has a reason to ask for. The microphone stays available because you chose it: the voice-note button records only after you press it, and your browser asks again the first time.

The site's build also excludes the server-side functions, the database layout and the mobile app source, so nothing that runs privately is published at a public URL. Those files stay in the private repository; they are simply no longer shipped out with the pages.

No website is unhackable and we will not claim otherwise. What this layer does is make the ordinary attacks — an injected script, a framed fake login, a page tricked into talking to a server nobody chose — fail in the open instead of quietly.

Accounts and signing in

The optional “My requests” area is handled by Supabase. Passwords are salted and hashed by that provider and are never stored in readable form by BrownHub; we cannot see yours, and no one writing to us can reset it without going through the same sign-in flow you use.

A confirmed phone number adds a one-time code by text message as a second step. The code is delivered by our SMS provider and expires on its own.

BrownHub staff will never ask for your password or for a code sent to your phone. If anyone claims to be us and asks, do not send it. Report it instead, at the address further down this page.

Payments

Checkout runs in Paystack's hosted window. Paystack holds the card and mobile money credentials; BrownHub receives only the item, the amount and a reference. Card details therefore never reach this website, our code or our mailbox.

Prices are shown in Ghana cedis and are confirmed in your quote before payment is requested.

Forms, spam and abuse

The contact form and the voice-note uploads are relayed to our mailbox by FormSubmit. They carry a hidden field that a human never fills in and a short minimum time before a send is accepted, both of which stop the great majority of automated submissions without affecting you.

Submissions that trip those checks are dropped silently; the sender still sees a confirmation, so a bot gets no signal about what stopped it.

The upload fields accept audio files of a bounded size and type. Nothing you send there is published anywhere on the site.

The chat assistant

The assistant in the corner answers from a written fact sheet about this studio. Your message travels to a single server-side function, which forwards it to the model and returns the answer. The key for that model lives in the function's configuration on the server, never in the browser, and the function refuses requests that arrive from any site other than this one. Each question and its answer are also filed in a log the studio can read, under a random code for your browser rather than your name; the database rule that accepts those entries lets a browser write and never lets it read.

It is still a third-party AI service. Ask it about prices, lead times and what we do; do not type an address book, a password or anything you would not send in an email.

What this site keeps on your device

Your chosen language, the dark or light theme, the state of your sign-in session, your cookie choice, and a random code that ties the chat assistant's answers to one conversation. That is the whole list, and you can inspect or clear it in your browser at any time.

The Cookie preferences window records what is allowed. Accepting or rejecting changes only what is stored in your own browser, and rejecting non-essential categories does not remove any part of the site.

What we never store

Card numbers, PINs, CVV codes, bank passwords, online-banking credentials, account passwords in readable form, or one-time codes. Not in a database, not in an email, not in a chat log.

Third parties involved

GitHub Pages serves the pages. Supabase provides sign-in, request history and the chat log. Paystack processes payments. FormSubmit relays the contact form and the voice notes. An SMS provider delivers verification codes. A large-language-model provider answers the chat assistant through our own relay. And if you turn the Advertising category on, Google's ad service fills the studio's display slot and sets its own cookies to choose and measure the ads; on a refusal it is never contacted at all. Each of them is bound by its own privacy policy and terms, and this page names them so that nothing is passed off as happening “in the cloud”.

Reporting a security problem

If you find a weakness on this site, or you believe a BrownHub account or a message from us is not what it claims to be, write to howelldaniel533@gmail.com with the word security in the subject line. Please send it to us directly rather than posting it publicly, so there is time to fix it first.

You can also reach the studio on WhatsApp at +233 50 295 4541, or read how personal details are handled in the privacy policy and the working terms on the legal page.