How to protect your account and data¶
What this is for¶
The page gathers the elements that decide account security: password, access to data, visibility in the community and irreversible account operations.
How to get there¶
Most settings are in Settings → Account & profile (/settings).
The public data-protection page is at /security (no login).
Step by step¶
- Set a strong password (at least 8 characters) and change it via Settings → Account & profile → Change password — details in logging in and password recovery.
- Regularly back up your data: Settings → Data → Export Data, as described in importing and exporting data.
- Check visibility: Show me in Society decides whether others find you in the community directory.
- Remove devices from notifications in Settings → Notifications if you don't want reminders delivered there.
- Report security problems through the public Contact form, not publicly.
Fields and options¶
| Element | Where | Behavior |
|---|---|---|
| Change password | Settings → Account & profile | Password change with the current password required. |
| Change email | Settings → Account & profile | Address change confirmed with the password. |
| Delete account | Settings → Account & profile | Account deletion after entering the password and confirming Delete forever. |
| Export Data | Settings → Data | JSON backup of all account data. |
| Show me in Society | Settings → Account & profile | Participation in the user directory. |
| Security page | /security |
Public description of data storage and protection. |
Common mistakes / pitfalls¶
- Delete my account is irreversible: it deletes tasks, projects, habits, messages and the rest of your data. According to the public Security page, data disappears from the live database and backups expire over time.
- The password is not stored in plain text — the app only verifies it; traffic runs over HTTPS and the database is split per account (Security page).
- There is no list of active sessions: signing out closes the only path available from the app; there is no screen for closing sessions on other devices.
- After many failed attempts, login gets a temporary lockout with a countdown — this protects against password guessing.