freeThe profile update at /m02/api/profile binds the whole JSON body onto your record. The visible form only sends name/phone — but the server never restricts which fields you may set. Think about what a privileged field would be called.
Other users' profiles live at /m02/api/users/<uid>/profile — including their invoice totals. You are uid 2. Try a neighbour.