If you use this, you're a genuine loser. This is CHEATING. Don't worry either, his AI generated vibe-coded slop site surely is as secure as possible when it comes to your personal information and data. Im SURE he is in compliance with federal and state laws as well regarding operating a SaaS platform as well. Do what you want with this information. In my testing, their is major exploits regarding raraaudio.com/. User's can access other user's accounts through synthetic bot account staging as well. The analytics code copies the full page URL, including its token, into another request. Both password-reset and login-callback pages load that code. I reproduced this offline with a fake token; the dashboard’s later URL cleanup happens too late to prevent the copy. Think of a password-reset link as a temporary key to your account. The site’s tracking code copies that key into a visitor-tracking request. If the server saves that request, the key could end up in records that people or tools use to analyze site traffic. Someone who gets that key before it expires might be able to take over the account. You are trusting Rara's server with your whole machine. The app runs elevated at every logon and accepts unsigned content from raraaudio.com, including installers it executes and a catalog value it pastes into a shell command. If Rara's backend is ever hacked, or the company turns malicious, that server can run arbitrary code on every user's PC with admin rights. It weakens Windows' own protections during setup. It auto-clicks the Windows driver-trust prompts while hiding them, disables the Electron renderer sandbox if a marker file exists, runs PowerShell with execution policy bypassed, and stores elevated scripts in a folder any local user can write to. On a single-user home PC the last point matters little. On a shared PC, another account could use it to gain admin. It changes the system without asking. It installs kernel-mode audio drivers, edits HKLM audio registry keys, turns Spatial Sound off on every output, turns Loudness EQ off on your other outputs, rewrites your Call of Duty settings files, deletes the Equalizer APO editor so you cannot inspect the config, adds autostart entries, and can reboot the PC immediately on a renderer command. Privacy: No discoverable policy link in the inspected public flows; common privacy routes returned 404. The site collects account email information and initializes visitor/session and affiliate tracking. Service terms: The auth form says users agree to terms, but supplies no link. Subscriptions and refunds: The site displays recurring plans, an introductory price, and “Cancel Anytime.” No refund policy was found through the inspected links or tested route Tracking and third parties: The analytics bootstrap creates persistent identifiers and attribution cookies without consent. For commercial sites collecting personally identifiable information from California consumers, CalOPPA generally requires a conspicuously posted privacy policy. This can apply based on the customers served, not only the operator’s address. California Attorney General explanation For covered U.S. online recurring-charge transactions, ROSCA requires clear disclosure of material terms before obtaining billing information, express informed consent before charging, and a simple way to stop recurring charges. A generic Terms page does not substitute for the required transaction disclosures. 15 U.S.C. § 8403.