Keeping your account safe

Settings → Security holds your password, two-factor authentication and your communication code. It also shows where you're signed in, and it's where you delete your account.

When you change your password, you sign out everywhere else

You give your current password and the new one, and that signs you out on every other browser and device. That's what you want if you're changing it because somebody might have had it.

If your account has no password just now, because we reset it for you, the page says so and points you at password reset instead.

Turn two-factor authentication on

It's optional, and worth it. You use an authenticator app on your phone, whichever one you already have.

Turning it on takes four steps:

1. Give your password.
2. Save your backup codes.
3. Scan the QR code with your authenticator app.
4. Type one code from the app, to prove it works.

Nydli switches nothing on until that last code is right, so a half-finished setup can never lock you out.

The backup codes come before the QR code. Each one signs you in once if you don't have your phone with you. You only see them in that step, so download them as a text file or copy them somewhere safe. Keep them somewhere that isn't the phone with the authenticator on it. Nydli asks you to tick a box saying you've saved them before you can carry on.

When you get to the QR code, you can scan it with two phones, or save it in your password manager. Then you have a spare if you lose one of them.

After that, Nydli asks for a code as well as your password when you sign in, and you can use a backup code if you need to. If you turn two-factor off, it asks for your password again.

We email you whenever two-factor is turned on or off, so you'll know if it wasn't you.

When your backup codes run low

Each backup code works once. Settings → Security shows how many you have left, and when you're down to three, it asks you to make new ones.

Make new backup codes asks for your password and gives you ten new codes. The old ones stop working at the same time, so save the new ones straight away.

Your email can't get you past it

We can't send you a code or a link by email if you lose your phone. That's on purpose. You turn two-factor on so your account stays safe even if somebody gets into your email, and an email that let you skip it would undo that.

If you lose both your phone and your backup codes, you need to get in touch with us. See Lost your phone?

Every email from us carries your communication code

It's at the top of the message, above everything else, and it looks like this:

Communication code: Panda4821
Check or change it in Settings › Security

When you get an email that says it's from Nydli and asks you to do something with your account, look for your code first. If it's missing, or it's a different one, the email isn't from us. Don't click anything in it, and open Nydli yourself instead.

Your account gets a code when you sign up, and you can change it to a word you'll recognise straight away. It can be 3 to 30 letters or numbers, and spaces and hyphens work too. When you change it, you give your password, and we send you an email with the new code at the top.

If you get that email and you didn't change the code, somebody else has your password. Press Sign out everywhere and change password in the email, as described below.

We'll never ask you for your code. It's there for you to check, and we already know it.

Our newsletters don't have the code. They come from hello@nydli.com, while the emails about your account come from no-reply@nydli.com.

You can see everywhere you're signed in

You'll see every browser and device you're still signed in on, each with the operating system it runs, roughly where it was used from and when. The one you're reading this on says This device.

• Sign out clears one of them.
• Sign out everywhere else clears them all at once, while leaving you signed in here.

Use the second one when you've been on somebody else's machine, or when you see a device you don't recognise.

You can check whether every sign-in was you

Under the sessions, the same page tells you what's been happening to the account. It logs:

• Every sign-in, and every refused one
• Every two-factor code, accepted or refused
• Every change to your password, email address, two-factor settings or communication code
• Every time somebody used Sign out everywhere and change password from an email

Each line names the browser and roughly where it came from, so you can tell at a glance whether all of it was you.

The list shows the ten newest lines, and Show all opens the rest. It holds the 100 newest events, and says so under the list once it's that full.

We keep this for 90 days. If something in it isn't yours, change your password and then turn two-factor authentication on.

If an email says you did something you didn't

Some of our emails tell you about something that was done inside your account with your password, like changing the email address or deleting the account. Each of them ends with a box that starts with Wasn't you?

If it wasn't you, somebody else has used your account. Press Sign out everywhere and change password in that box. It opens a page in Nydli, and nothing happens until you've typed a new password there and saved it. When you save:

• We sign the account out on every browser and device, the one you're on too.
• We stop what the email was about. If it was a new email address or a deletion, neither goes ahead.
• We disconnect any AI assistants connected to your account.
• If two-factor authentication was turned on in the last seven days, we turn it off, because it might be somebody else's phone. You can turn it on again with your own.

Then you sign in with the new password. The sign-in history further up this page shows you where the account has been used.

The link works once, for seven days. If it has expired, use Forgot your password? on the sign-in page instead. That signs the account out everywhere too.

You get 7 days to change your mind about deleting

We don't delete straight away. We keep your account as it is for 7 days, and if you cancel within that window, you carry on as before. We email you when the countdown starts, and you can stop it in Settings at any point before the date. To start it, you give your password and type your email address exactly.

Before you get that far, the page tells you what happens either way.

What stays behind. Your tasks, time and files in workspaces you share with other people stay where they are, listed under a deleted user, so your colleagues keep their records. The page counts them for you.

What goes. We delete your name, your email address, your profile picture, your sign-in history and every personal setting. Any workspace where you're the only member goes with the account, and the page names those workspaces before you agree to anything. You won't be able to sign in again.

Two things stop a deletion before it starts, and the page names them:

• You own a workspace other people are still working in. Remove them, or delete the workspace, first. We won't let deleting your account take away somebody else's work behind their back.
• You have a live subscription. Cancel it first, so the billing stops with the account. See Your subscription.

If you want a copy of your work before it goes, take one first: Settings → Profile → Download your account data for your account, and, if you own the workspace, Download the workspace for the work itself. See Exporting your work.