Security Patches, Legal Pages, and Search Improvements. 6/17/2026

We closed four security holes

None of these were actively exploited, but they were real issues that needed fixing.

1. A payment status page was leaking information. After checkout, we have a page that checks whether a payment went through. That page was returning your email address and account ID to anyone who had the checkout link — even if they weren't logged in. Checkout links can end up in browser history or server logs, so this wasn't acceptable. We've locked the page down so only the person who made the purchase can see the result.

2. The analytics dashboard wasn't properly checking who you were. The dashboard has a page that shows subscription stats. The code was supposed to check your login before showing data, but it wasn't actually validating it properly — it was trusting a shortcut that doesn't verify identity. Fixed.

3. Stripe was being told to retry webhook events indefinitely. When Stripe processes a payment, it sends us a notification. If our server returned an error, Stripe would keep trying — potentially for days — and could eventually disable the connection entirely. We've fixed it so database errors are logged quietly and Stripe is told everything is fine, rather than being asked to keep retrying.

4. A misconfiguration could have activated the wrong subscription. We had a dictionary that maps Stripe price IDs to our products. If an environment variable was missing, the dictionary would create a blank entry that could accidentally match any unrecognised price ID and activate the wrong subscription. The code now handles missing values safely.

---

Privacy Policy and Terms of Service are live

We should have had these earlier. They're now at asix.live/privacy and asix.live/terms, and the links in the footer actually work.

The short version: we collect your email address and subscription status. Payments go through Stripe — we never see your card details. We don't sell your data or use tracking cookies. You can ask us to delete your data at any time by emailing privacy@asix.live.

We've also added a small notice at the bottom of the site that explains the cookies we use (just login and payment cookies — nothing for advertising).

---

Google can now find the site properly

We added a sitemap, which is a file that tells search engines which pages exist and how often they change. We also added a robots file that tells search engines which pages not to index (like the login page or checkout — there's no reason for those to show up in search results).

We also cleaned up some old references to the site's previous domain name (asixstud.io) that were still appearing in a few page titles.

---

What's coming next

• A way to delete your account from within the app (required by data protection law — it's the last legal item on the list)
• New use-case pages for Ascend: stopping doomscrolling, reducing screen time, beating procrastination, quitting vaping
• Fixing the social preview images for the product pages (they're currently broken)