Lumekara
IDEN
All projects
Backend

Secure Login and Personal Data Controls

Sign-in with email OTP, password, or Google, cookie-based sessions, recorded data consent, and self-service account deletion.

Status
Live
Layers
BackendFrontend
Used by
Students and parents who create a Numekara account, and the business owner who must protect their data.
Ask about this project
The Numekara sign-in page with Google, password, and email code options
Screenshot

The problem

People hesitate to sign up if they doubt their data is safe, and businesses need proof of consent and a way to delete data on request.

The solution

Authentication uses Supabase Auth with server-side PKCE and httpOnly cookies. Consent records can't be edited, logs filter out personal data, and users can delete their own accounts.

How it works

What happens, step by step, from the user's point of view.

  1. 01

    Choosing how to sign in

    Sign in with an email OTP code, a password, or a Google account. Free sign-up works without creating a password.

  2. 02

    Code requests are limited

    Before a code is sent, the server checks how often that address has asked already. This stops abuse and saves the email quota.

  3. 03

    Session kept in secure cookie

    Once signed in, the login token is kept in a cookie that scripts on the page cannot read.

  4. 04

    Data consent is recorded for good

    When a user agrees to how their data is used, the record is saved and can't be edited. The business has proof if asked.

  5. 05

    Personal data stays out of logs

    Emails, WhatsApp numbers, and names are filtered out of server logs, so the team doesn't see them while fixing problems.

  6. 06

    Users can delete their account

    The user types a confirmation phrase and the account is deleted. Learning data goes with it; transaction records stay, without the owner's identity.

System design

Who uses it, what they see, what works behind the scenes, and where the data lives. Read it from left to right.

  1. 1People

    • Students and parentsCreate an account, sign in, and manage their own data

  2. 2What they see

    • Sign-in pageChoice of email OTP code, password, or Google button
    • Delete account pageAsks for a confirmation phrase before the account is deleted

  3. 3Behind the scenes

    • Web serverNext.js completes the login on the server and sets a secure cookie
    • API serverFastAPI limits OTP codes, records consent, and deletes accounts

  4. 4Data and outside services

    • Supabase AuthSends OTP codes and verifies Google sign-ins
    • DatabasePostgreSQL stores profiles, consent records, and the audit log

Key features

  • Email OTP, password, and Google
  • httpOnly cookie sessions
  • OTP quotas against abuse
  • Permanent consent records
  • Self-service account deletion

Built with

  • Supabase Auth
  • Next.js
  • FastAPI
  • PostgreSQL

What the business gets

  • People can sign up without remembering yet another password.
  • The business holds consent records that can't be altered.
  • Data deletion requests are handled by users themselves, without waiting for an admin.
  • The email quota isn't drained by excessive code requests.

Terms on this page

OTP
A one-time code sent to your email to prove the address really is yours.
Cookie
A small note your browser keeps so you stay signed in as you move between pages.
Log
The server's technical diary of what happened, used by the team to track down problems.
Supabase Auth
A ready-made service that handles accounts, sign-in codes, and Google login.

Can it work for your business?

A ready foundation for login and privacy in your app, in line with your duty to protect customer data.

Ask about this project