User

Email — must be unique; at least one of email or phone required
Phone — India (+91) only; not stored unless OTP is verified
Google login — same email cannot link to two different Google accounts
Google profile picture — copied to our storage on first login if user has no photo
Apple login — Apple users may hide their email
Microsoft login — planned, not yet live
Username — unique; auto-generated on SSO sign-up if not set
Role — student, editor, admin, or sys_admin; only enforced on admin panel
Name — first and last
Profile picture — one photo per user, stored privately
Date of birth
Gender
Bio
Background info
Attempt number
Attempt year
Address — street, city, state, zip, country
Courses — up to 5; duplicates ignored
Social links — LinkedIn, GitHub, Instagram, Facebook, Twitter, Reddit
Active devices — up to 2 web and 2 app; oldest signed out when a 3rd logs in
Last login per device
Last session reset — invalidates all older tokens
Soft delete — email and phone are scrambled on deletion