Skip to main content

Your Account

Account → Profile, on four tabs: Profile (your name, your sign-in address, the language and theme of this dashboard), Security (password, two-factor, sign-ins), AI & keys (connected AI clients, personal keys, and what they read) and Data & account (a copy of everything we hold about you, closing the account, the documents you agreed to). The tab is in the address (?tab=security), so a link can point at a control rather than describe where it is. One Save changes bar at the foot of the screen saves every form you touched; leaving the page with unsaved work asks first.

Interface language and theme​

Both are remembered in this browser only — a teammate reading the same dashboard keeps their own. The theme offers a third choice the top bar's button does not: System, which follows the operating system and moves with it at sunset.

Changing the address you sign in with​

An email change takes two steps, and nothing moves until the second one.

Edit the address and a Current password field appears — required only for an address change, never for a rename. Saving parks the new address and sends a confirmation link to the new address. Until you open that link you keep signing in with the old one, and the panel says so:

Waiting for you to confirm new@example.com. You still sign in with old@example.com until then.

The link expires; Send the link again issues a fresh one, up to three times an hour.

This is two steps because of what a typo now costs. If a locked account can only be recovered through a link sent to its address, then an address changed to one you cannot read is an account you cannot get back. The confirmation reads the address off the link itself, so if you request a change to B, change your mind to C, and then open the B link, the B link is simply stale — it cannot move you somewhere you no longer asked for.

Confirming your address​

A new account signs in only after its address is confirmed. Registering sends a link to the address you typed and shows Check your email; open the link, then sign in. Signing in before that sends a fresh link. Registration answers exactly the same way whether or not the address already has an account. If it does, its owner gets a mail saying somebody tried, and nothing changes. So the registration form cannot be used to find out who has an account here.

If you register from an invitation, the address is already proved — the invitation was mailed to it — so you are signed in straight away.

Accounts made before 19 October 2026 that never confirmed still sign in. A banner across the dashboard asks them to confirm:

Confirm your email to invite teammates.

For them, being unconfirmed blocks one thing: sending invitations, because those spend our sending reputation on somebody else's inbox.

Password​

The new password must be at least 8 characters and differ from the current one; the confirmation never reaches the server, it only guards against a typo. Changing it signs out every other browser and device and ends every connected AI client and personal key — this browser stays signed in.

Two-factor authentication​

Turning it on asks for your password first (a session alone must not be able to enrol an authenticator), then shows a key to add to your authenticator app and asks for the six digits it shows. The recovery codes appear once: only their fingerprints are stored, so that screen is the only place they exist. Turning it off needs a current code. Operator accounts do not see this panel — a second factor is mandatory for them and managed by the deployment.

Sign-ins​

The panel is called Sign-ins, not Devices, and the difference is real: signing in again from the same browser creates a new entry. Three entries can be one laptop. Telling them apart would require fingerprinting the browser, which this product refuses to do to your visitors and will not do to you either.

Each row shows the browser and platform as far as they can be read, when the sign-in happened, when it was last used, and — if one was recorded — a rough area rather than a full IP address. Your current session is tagged This browser and has no sign-out button, because signing yourself out of the tab you are reading is not a feature.

  • Sign out on a row ends that one sign-in.
  • Sign out everywhere else ends all the others and leaves this one, so you can see that it worked. It also ends every connected AI client and every personal key — see Connect your AI client.

Changing your password does the same thing automatically: every other browser is signed out, this one stays.

Billing​

Profile → Billing lists every organization you belong to, with its plan and a link to that organization's billing page. A plan belongs to an organization, not to a person, and only the organization's owner chooses, changes or cancels it — see Plans, usage and billing. The list is there so you can find where each of your organizations pays without remembering which one holds which plan.

Connected AI clients​

The AI clients you connected through the Model Context Protocol, each with the sites it may read, when it was connected and when it last read anything. Rename gives one a name of your own; Disconnect ends it at once, and Disconnect all ends every one. A connection we ended says why — the consent list grew, or the account's password or sessions were reset. See Connect your AI client.

Personal keys​

A key for a script, a server or an AI client that sends a header instead of signing in. Create a key asks for a name, the sites or whole organizations it may read, how long it lives, whether it may make changes — read only unless you allow them, and final once created — and your password; the key is shown once. Each row says what it reads, whether it may make changes, when it expires and when — and from which network — it was last used. Revoke ends it at once. See Personal keys.

Below the keys, What keys and AI connections read counts every call your keys and AI connections made — answered, refused and failed — per day, tool, site and credential, and narrows to one site, one key or connection, or one tool. See Seeing what it read.

Your data​

Export my data downloads a JSON file with your profile, the organizations and sites you belong to and how they are configured, your subscription and invoices, the invitations you sent, and the record of actions you took.

Two exclusions are deliberate:

  • No credentials. Site API keys, Slack webhooks, Telegram tokens and the like come back as <redacted>. The setting name survives, so "is Slack configured" is still answerable — but an export is a file that gets emailed onward, and a site key in an export is a site key in somebody else's inbox.
  • No collected rows. Errors, leads and recordings are exported per site, as CSV, from their own screens — those streams are paged and can run to tens of thousands of rows, and a second path that loads them all into one JSON file would fail on exactly the sites that most need it.

This is your own account data. For the data you hold about a visitor — their export and their erasure — see GDPR and the Visitors screen.

The Terms of Service, Privacy Policy, Cookie Policy, GDPR and US Privacy notes and the Data Processing Agreement, as published on this docs site. Reference only; nothing on that tab changes anything.

Closing the account​

Close this account deletes it permanently. There is no undo and no grace period.

Before you type anything, the panel shows What goes with it: every organization that will be deleted and every site inside it, by name. The rule is one sentence —

An organization dies with the last of its owners.

— so an organization you share with another owner survives your departure, keeps its sites and its data, and is listed separately as kept, because someone else owns them too. You need to know that before you decide, which is why the preview names both lists rather than only the casualties.

Closing requires your password and then typing your email address to confirm. The password is required by the server, not just by the form: a stolen session must not be able to end an account.

If you are the only super admin, the button is replaced by:

You are the only super admin. Promote somebody else before closing this account.

An empty console is a state nobody can leave through the product, so it is refused before you start rather than after.