Security Practices

This site is a static website hosted on Cloudflare Pages. There is no server-side application, database, login system, or payment processing on this domain — every purchase happens on Google Play Books, which has its own independent security practices.

What's actually in place

• HTTPS everywhere — enforced automatically by Cloudflare Pages, with HSTS (Strict-Transport-Security) set to a one-year max-age including subdomains.
• Content Security Policy — a locked-down CSP restricting scripts, styles, and frames to a specific allowlist of trusted origins (see the site's _headers file).
• Clickjacking protection — X-Frame-Options: SAMEORIGIN.
• MIME-sniffing protection — X-Content-Type-Options: nosniff.
• Restricted browser feature access — camera, microphone, payment, and USB APIs are explicitly denied via Permissions-Policy.
• Referrer control — Referrer-Policy: strict-origin-when-cross-origin.

What this site does not hold

No user accounts, no passwords, no payment card data, and no server-side database of personal information. Any personalization (reading history, wishlist, feedback votes) is stored only in the visitor's own browser (localStorage) and never transmitted to HDL Group.

Reporting a concern

If you believe you've found a security issue with this website, email carlifornia26@gmail.com with details. This is a small, static site with no bug-bounty program at this time, but reports are read and acted on.

Last updated: 2026-07-28.