Sign in

How we handle your password and account

• Authentication is provided by Supabase Auth over HTTPS. ReactorMC never sees, stores, or logs your password — it goes directly from this form to Supabase, where it is hashed with bcrypt before being saved.
• If you choose Continue with GitHub, you authenticate on github.com. ReactorMC only receives your GitHub username, avatar URL, and email — never your GitHub password.
• Your session is kept in your browser's local storage as a short-lived JWT. Signing out deletes it. The site has no server we control that could leak it.
• We don't share or sell your email, and we don't send marketing. The only emails Supabase sends on our behalf are account confirmation and password reset.
• To reduce spam, you must verify your email before you can upload a model, comment, or rate. GitHub sign-in skips this step because GitHub has already verified your email.
• For your protection, we also limit how many models, comments, and ratings a single account can submit per day, and we log all moderation actions for forensic review.
• Found a security issue? See our disclosure policy.