Thanks for the kind words and the excellent question! Security is something I take seriously, so let me explain how SkyStatus Pro handles your data:

First of all: Local Mode Option
If you prefer not to use cloud storage at all, there's a "Local Mode" that keeps everything in your browser's localStorage. The trade-off is no sync across devices and data loss if you clear browser data.Just export the JSON and import it the next session.

Database & Infrastructure
The project uses Supabase as its backend, which is built on PostgreSQL and hosted on AWS infrastructure. Supabase is SOC2 Type II compliant and used by thousands of production applications.

Encryption
- In transit: All data is encrypted via TLS/HTTPS
- At rest: Supabase encrypts all data at rest using AES-256 by default
- Authentication: uses secure JWT tokens with proper expiration

Row Level Security (RLS)
Yes! PostgreSQL Row Level Security is enabled on all tables. This means even if someone somehow got database access, they can only see their own data. Every query is automatically filtered by user_id. It's not just application-level security. It's enforced at the database level.

What data is stored?
Only what you enter: flights, miles transactions, and your qualification settings. I don't store Flying Blue credentials, credit card info, or anything beyond what's needed for the analytics. The PDF import extracts data client-side in your browser. The PDF itself is never uploaded to any server.

On the PDF import issues:
You're absolutely right that the current PDF import has limitations. I'm actually in the process of completely rebuilding the PDF import system from scratch. The current implementation doesn't reliably detect qualification cycles and status transitions for all users, which leads to the XP/UXP calculation issues you're experiencing.

On PFL (Platinum For Life) tracking:
Good suggestion. This would require tracking consecutive years at Platinum level. Once the qualification cycle detection is solid, this becomes feasible to implement.

For now, I've added a notice in the app warning users about the PDF import limitations. Manual entry still works reliably if you need accurate tracking in the meantime.

Happy to answer any follow-up questions!