Security and Data

Current architecture

Pitchside Web uses Firebase services for authentication, Firestore data storage and Firebase Storage media uploads. Public website content is served through the Next.js App Router.

Data handled before launch

• Waitlist and contact form submissions: name, email, intent, message and source page.
• Account deletion requests: email, platform, reason, request date and status.
• CMS media uploads for website pages and articles.
• Future app footage and analysis data should be covered by updated privacy, retention and security documentation before public launch.

Security expectations

• Admin access should be restricted through Firebase Auth and Firestore/Storage security rules.
• Sensitive server credentials must not be exposed to the browser.
• Payment handling must not launch until checkout, cancellation, refund, tax and store-policy requirements are approved.
• Data retention and deletion rules should be documented before public app access expands.

Contact

Security or privacy questions can be sent through the contact page. Pitchside should publish a dedicated security contact before broad public launch if vulnerability reports are expected.