Policies
Security disclosure
What we built to protect your account and your reading — and, just as importantly, what we are not going to claim it does.
Last updated 15 October 2026
What this platform is not
Read this first
We do not describe this platform as unbreakable, uninspectable, screenshot-proof or leak-proof, because none of those things is true of any website. The browser, the operating system and the screen in front of you belong to you. We build layered, proportionate protection and we report its limits plainly.
Anything that tells you a website can stop a determined person reading text off their own screen is selling something. We would rather be honest and slightly less reassuring.
Protecting your account
- Passwords are hashed with a slow, adaptive algorithm and salted. We cannot read them, which means nobody here can impersonate you.
- Sessions live in a cookie marked HttpOnly, Secure and SameSite, so scripts cannot read it and it is not sent to other sites.
- The session token is an opaque random reference, not your user id, and it can be revoked.
- Sign-in and recovery are rate limited, and recovery tokens are short-lived and single-use.
- Signing in from a new device is visible to you, and you can end any session.
- Failed sign-in attempts do not reveal whether an account exists.
Protecting the books
- Master files are held in private storage with no public URL and no listing.
- Book pages are delivered one at a time, only after the server re-checks your session and licence on that specific request.
- Those responses are marked private and no-store so they are not kept in a shared cache.
- Every page carries a visible mark derived from your masked account reference, so a leaked page can be traced to an account.
- Unusual request volume from one account is detected and rate-limited.
- No advertising or analytics script runs anywhere on a reader or library page, because a third-party script on a reading page is a third-party script with a view of what you are reading.
Payments
- Card entry happens on Paystack's hosted page. We never receive your card number, security code or PIN, and we could not leak them if we tried.
- Prices are set on our server. A browser cannot tell us what to charge.
- Access is granted only after the payment provider confirms success on our server. A redirect or a screenshot is never proof.
- Every provider event is recorded with a unique identifier and processed once, so a retried webhook cannot grant access twice.
Staff and administration
- Every staff member has an individual named account. There is no shared login.
- Privileged actions require multi-factor authentication and are written to an append-only audit log with the actor, time, reason and outcome.
- Staff roles are separated so that nobody can both publish content and approve refunds alone.
- Support staff cannot export the user list or see payment credentials.
- Secrets live in our platform's secret store, never in source code, logs or bundles.
Transport and browser policy
- The whole site is served over HTTPS with strict transport security.
- A Content Security Policy limits what the browser will load and from where.
- The site cannot be framed by another site, and it blocks cross-origin opener and resource policies.
- Permission access to the camera, microphone and location is denied, because we do not use them.
Report a security concern
If you have found a way to get at a title you did not buy, or you believe an account has been compromised, email hello@distinctlearnersseries.com with what you found and how you found it.
We will acknowledge a genuine report within two working days. We will not threaten you with legal action for reporting a problem we then fix, and we will credit you publicly if you want us to.
- Please give us a reasonable window to fix it before disclosing publicly.
- Do not access other people's data. Finding a bug and proving you had access to someone's library is a very different thing.