Your account and security

Manage your own account from Your account in the sidebar (on a phone, More → Your account).

Profile

Your name appears to teammates and in the change history. Your email address is your sign-in and can’t currently be changed. If you need to change it, contact support.

Password

Change your password with your current one under Password. Changing it signs you out on every device, including this one.

Forgotten it? Use Forgotten your password? on the sign-in page. The reset link lasts 30 minutes and works once.

Two-factor authentication

Two-factor authentication (2FA) asks for a 6-digit code from an authenticator app (such as 1Password, Google Authenticator, Microsoft Authenticator or Authy) as well as your password when you sign in. We strongly recommend it for owners and admins.

To turn it on:

1. Under Two-factor authentication, click Set up two-factor authentication and confirm your password.
2. Scan the QR code with your authenticator app, or type in the key shown.
3. Enter the 6-digit code the app shows and click Turn on.
4. Save your recovery codes. You get ten, and each works once. If you lose your phone, a recovery code is the only way to sign in. Keep them in a password manager or print them.

When signing in, enter the code from your app, or click Lost your device? Use a recovery code. Resetting your password doesn’t bypass two-factor authentication.

Running low on recovery codes? Click New recovery codes (the old ones stop working). To turn 2FA off, click Turn off and enter your password and a code. We email you whenever 2FA is turned on or off.

Sign out everywhere

Lost a laptop or used a shared computer? Sign out everywhere ends every session on every device immediately.

Your data

• Admins can download everything their organisation holds as JSON, and its change history as CSV. See Change history and export.
• Deleting your account removes it and any organisation where you’re the only member, including its data and subscription. You’re removed from shared organisations. If you’re the only owner of an organisation with other members, make someone else an owner first.

How your account is protected

Passwords are stored using Argon2id hashing, never in plain text. Two-factor authentication is available to everyone, on every plan. Sessions expire quickly and are renewed securely in the background. Sign-in attempts are rate limited, and all data is encrypted in transit and at rest. Read the full security overview.