How we protect your account
A plain-language explanation of what happens behind the scenes when you sign up, sign in, or reset your password.
One device signed in at a time
PulseMyBasket allows only one active signed-in session per account. If you sign in on a new phone, browser, or computer, your previous session is automatically signed out. This limits the damage if a device you signed in on is lost, shared, or compromised.
Your password is never stored in readable form
We store passwords using Argon2, a modern, deliberately slow hashing algorithm designed to resist cracking even if a database were ever exposed. We can't look up or recover your actual password. If you forget it, you'll need to reset it.
Secure password reset
A "forgot password" request sends a one-time link containing a long, randomly generated code. That code can only be used once, expires after a short time, and resetting your password automatically signs out any existing session, so a stolen link can't be reused, and a successful reset locks out anyone else who was signed in.
We don't confirm whether an email has an account
Our "forgot password" page always shows the same response, whether or not that email is registered. This prevents someone from using it to check which email addresses have accounts.
Rate-limited sign-in
Repeated rapid attempts to sign in, request a password reset, or create accounts are automatically throttled to slow down abuse.
Session cookie protections
Your sign-in session is stored in a cookie that page scripts cannot read (HttpOnly), that is only sent over HTTPS outside local development (Secure), and that browsers won't send along with requests from other sites (SameSite).
If you didn't expect to be signed out
Being signed out unexpectedly usually just means someone (often you, on another device) signed in to the same account. If you don't recognise that sign-in, change your password immediately and contact us via Contact.