Disclosure: I'm the TL of this project on Chrome and I work very closely with the Safe Browsing engineers regularly.

> What if Google's algorithms classify your new startup as "potential phishing", because users are re-using their own passwords on your site?

That's not how our phishing detection works. In fact, our internal studies show that a lot of users reuse their passwords often and while that's not the best password hygiene, it's the user's choice to make and we have to respect that and build protections with this in mind.

> How can you appeal?

Right from your search console.

> What recourse do you have against Big G's algorithm?

Ultimately, Google/Safe Browsing has a lot more to lose if their users stop trusting their product(s). I can tell you that we take false positives very seriously and try hard to provide a fair and speedy resolution.