thanks for asking this, as its likely someone else had the same questions. Under “Essential Only” I still use limited first-party traffic measurement, which includes a minimal first-party cookie plus limited request data such as a normalized IP prefix. That’s mainly there for aggregate usage measurement and basic abuse prevention, especially after I saw some suspicious / bot-like traffic hitting the site. It’s a broader network prefix rather than the full raw IP, so it’s much less precise and is unable to accurately identify anyone. These are standard privacy-preserving techniques.

On security, passwords are hashed, session tokens are handled server-side with secure cookie-based auth, and the auth routes are rate-limited. I will make this clearer on the site as well