Security at MedMoneyGuide

• Your name and email address, whether you sign up with email or with Google
• Your sign-in credentials, managed by our authentication provider. Passwords are hashed, so no one at MedMoneyGuide can see them
• The numbers you choose to enter in onboarding and your dashboard, such as income, account and loan balances, interest rates, and PSLF payments
• Calculator results you choose to save
• Your settings and email preferences

• ✕Social Security numbers or government ID
• ✕Bank, brokerage, or loan servicer logins. We never connect to your financial accounts
• ✕Credit reports. We never pull your credit
• ✕Payment card details. We don’t process payments
• ✕Health or medical records

• Every connection to medmoneyguide.com is encrypted with HTTPS (TLS)
• Accounts and dashboard data are stored with Supabase, and the site is hosted on Vercel
• Database access rules (row-level security) ensure each account can only read and change its own data
• Passwords must be at least 8 characters with uppercase, lowercase, a number, and a symbol, and passwords found in known data breaches are rejected
• Sign-in links and password-reset links work once and expire

Calculators run in your browser. The numbers you type aren’t sent to us unless you’re signed in and choose Save to dashboard.

• Change your password anytime in Profile & settings
• Sign out from Profile & settings, especially on shared computers
• Turn analytics cookies off in Cookie settings
• Delete your account and data by emailing editorial@medmoneyguide.com

Use a password you don’t use anywhere else, especially not for a bank or loan servicer. See our Privacy Policy for full details on data we collect and your rights.

If you find a vulnerability, such as a broken sign-in flow or exposed data, please tell us privately before sharing it publicly. Email editorial@medmoneyguide.com with the subject Security vulnerability report, a description, steps to reproduce, and any screenshots.

We’ll acknowledge your report within 2 business days and keep you updated while we fix confirmed issues. Please don’t access other people’s data, disrupt the site, or run automated scans that degrade it.