Short-lived access tokens keep browser exposure tight while refresh sessions stay server-backed in PostgreSQL.
Protected routes gate the dashboard instantly, then confirm session integrity close to the data layer.
Every new signup starts on the Free plan by default, ready for tracking from the first login.