Passwords are stored as bcrypt hashes only — never in plain text. Pro phone/email are never shown on public pages.