Manage your account and sign-in

Email and social login

Register with an email address and verify it using the link sent by the installation. The operator must configure outbound email for verification and password reset. Google and GitHub login appear only after the operator configures those services.

Social login verifies the external identity. An existing email account is not silently linked just because a provider returns the same email address. Use your established sign-in method when a matching account already exists.

Two-factor authentication

In account settings, enable an authenticator and add the displayed secret to a compatible TOTP app. Confirm a current code to finish enrollment. Save recovery codes somewhere separate from your device. Each recovery code can be used once.

Never send an authenticator secret, recovery code or password to support. If you lose all recovery methods, the operator needs to follow a documented identity-verification process before changing access.

Sessions

Review your active sessions in account settings and remove ones you no longer use. Session records include the browser user agent, IP address and recent activity. Sign out when using a shared computer.

Passwords and deletion

Change your password or use the email reset flow when needed. Sensitive account actions require a password or recent authentication. Account deletion removes the application's records and private files associated with your account. Export anything you need first.

The operator should protect the server, configure HTTPS, update dependencies, and keep encrypted backups. Application controls do not replace those responsibilities.