ChanTan Studio DocsSecurity and Privacy in ChanTan Studio
Keep your ChanTan Studio account safe: password rules, signing other devices out, what's kept private, and exactly what to do if you think someone else got in.
Everything about keeping your account safe sits in one place: Settings → Security. This page explains what's there, what ChanTan protects for you automatically, and what to do the moment something feels wrong.
If you think someone else got into your account — do this now
- Go to Settings → Security.
- Press "Log out everywhere else".
- Change your password on the same page.
- If you saw anything you didn't do, email support@chantan.studio.
Your password
Under "Password":
- Type your current password.
- Type a new password of at least 8 characters.
- Confirm it.
- Press "Change password".
Asking for your current password is deliberate — an unattended open laptop isn't enough for someone to take over your account.
✅ After a successful change, every other device is signed out. The one you're using stays signed in.
⚠️ The sign-up box shows an out-of-date hint. It reads "Password (6+ characters)", but the form itself refuses anything under 8 and says "Use at least 8 characters." Eight is the rule everywhere. If a page still refuses a password of 8 or more, don't keep retrying — contact support@chantan.studio.
Password length rules, in one table:
| When | Minimum |
|---|---|
| Creating the account | 8 characters (despite the "6+" hint on the box) |
| Changing it in Settings | 8 characters |
| Resetting a forgotten password | 8 characters |
One rule, everywhere: eight characters or more.
Signing other devices out
"Devices & data" → "Log out other devices" — "Ends your session on every device except this one." Press "Log out everywhere else".
Use it when you've signed in on a shared, borrowed or public computer and can't get back to it.
Two other moments sign devices out for you automatically:
| What you did | What happens |
|---|---|
| Changed your password in Settings | Every other device is signed out; you stay in |
| Reset a forgotten password | Every device is signed out, including your phone |
The reset case is stricter on purpose — recovery assumes something may have gone wrong.
Forgot your password?
Use "Forgot password?" on the sign-in page. The full walkthrough, including what to do when the email doesn't arrive, is in How to log in.
Two safety details worth knowing:
- You always see the same confirmation — "If an account exists, we sent a reset link." — whether or not that email has an account. That's deliberate, so nobody can use the page to discover who has an account.
- 3 reset emails per address every 15 minutes, and each link works once.
The security check on sign-in
The tick-box above "Sign In" is there to stop automated attacks. The button stays greyed out until it passes, and it resets after every failed attempt.
If it won't appear at all, an ad-blocker or a strict network is usually blocking it — pause the blocker for this site and press "Try again".
What ChanTan protects for you automatically
You don't have to configure any of this:
| Thing | How it's protected |
|---|---|
| Your card details | Payments go through Stripe's secure checkout — ChanTan never sees your card number |
| Provider keys you paste (Stripe, email, and similar) | Stored encrypted, used only on the server, never shown in chat or in your code |
| Login accounts the AI creates for your app | Saved under the project's "Manage" → "Chat history, logins & files", with passwords encrypted — only you can reveal them |
| Code pushed to GitHub | Repositories are always created private, and database keys are replaced with placeholders before anything is sent. If that can't be guaranteed, nothing is sent at all |
| Your published app | Publishing runs an automatic security review and stores a report for you — it never blocks the publish |
The "Secure" badge on your project
The green "Secure" shield in the project header opens that project's security overview.
A red dot on it means the AI recently created new data tables and you should choose who can see that data — public, only signed-in users, or only each user's own rows. It's one click per table, and the AI explains the choice in plain words.
Privacy: what stays private
- Your preview link is private and temporary — it isn't the way to share your site. The published address is the real, permanent public one.
- Repositories pushed to GitHub are private, on your own account.
- Your domain contact details, when you buy a domain, are stored encrypted.
- The note in "What Chantan knows about you" is read by the AI on every build — so treat it as notes about your taste, never as a place for secrets.
Honest limits
- There's no two-factor authentication (2FA) today, and no list of your active sessions with device names — the tool you have is "Log out everywhere else".
- There's no delete-account button. Write to support@chantan.studio if you want your account removed.
- Account and security emails are in English only today — the approval email, the password reset email and email-change confirmations. The rest of the app is translated.
- Account and security emails can't be switched off — that's a safety feature, not an oversight.
Anything that looks like a real security problem goes straight to support@chantan.studio.