Account and security

Two-factor authentication

Settings → Profile → Enable two-factor: confirm your password, scan the QR code (or type the key) in any authenticator app, enter the first code, and save the ten backup codes somewhere safe — each works once. From then on sign-in asks for a code; you can trust a device for 30 days, or have a code emailed to you if the app is out of reach. Five wrong codes lock the factor for 15 minutes.

Sessions

Every signed-in device is listed with the address it signed in from, this one first. Sign out any of them. Changing your password signs out everything else.

Password and email

Change your password with the current one. Changing your email is two steps: confirm on the old address, then verify the new one. Forgotten passwords go through reset, which also signs out every session.

Profile photo

PNG, JPEG, WebP, or GIF up to 2 MB. It shows in the sidebar and on the team page.

Workspace export

Settings → Workspace → Export builds one zip — workspace.json, lanes.json, leads.csv, events.csv for the last 90 days — and emails a link that works for 7 days. Admins only.

Deleting a workspace

Type the workspace name to schedule deletion. Every admin is emailed; the sidebar shows a countdown; any admin can cancel within 14 days. After that, lanes, screens, leads, and events are purged.

Deleting your account

Settings → Profile → Delete account sends a confirmation link. It is refused while you are the only admin of a workspace that still has other members — hand off first.

How all of this is protected is on the security page.