The main reason was the sharing mechanism. When you share your list with someone, you can type in their email even if they don't have a Gift Tracker account. Wh

The main reason was the sharing mechanism. When you share your list with someone, you can type in their email even if they don't have a Gift Tracker account. What will then happen is an account will be created for them with no password. When they end up following through on the share link and viewing the list, they'll be using their newly created account. Near the top of the page, a message will appear suggesting that they lock down their account with a password. So to answer your question, nothing but knowing the user's email address stops someone from logging into their account.