Skip to main content

Keeping your account safe

Settings → Security holds your password, two-factor authentication, the record of where you're signed in, and deleting your account.

Changing your password​

Give your current password and the new one. Changing it signs you out everywhere else, on every other browser and device, which is what you want if you're changing it because somebody might have had it.

If your account has no password just now, because an operator reset it, the page says so and points you at password reset instead.

Two-factor authentication​

Optional, and worth it. Nydli uses an authenticator app (TOTP): 1Password, Authy, Google Authenticator, whichever you use.

Turning it on asks for your password, shows a QR code to scan, and asks for one code from the app to prove it works. Nydli switches nothing on until that code is right, so a half-finished setup can never lock you out.

You then get a set of backup codes, shown once. Keep them somewhere that isn't the phone with the authenticator on it. They're the way back in if you lose the device.

After that, signing in asks for a code as well as your password. You can use a backup code instead of the app if you need to. Turning two-factor off asks for your password again.

Where you're signed in​

You'll see every browser and device you're still signed in on, each with the operating system it runs, roughly where it was used from and when. The one you're reading this on says This device.

Sign out ends any single session, and Sign out everywhere else ends all of them at once while leaving you signed in here. Use it when you've been on somebody else's machine, or when you don't recognise a session.

Sign-in history​

Under the sessions, the same page tells you what's been happening to the account. It logs every sign-in and every refused one, every accepted or refused two-factor code, and every change to your password, email address or two-factor settings. Each line names the browser and roughly where it came from, so you can tell at a glance whether all of it was you.

We keep this for 90 days. If something in it isn't yours, change your password and then turn two-factor authentication on.

Deleting your account​

Deleting is scheduled rather than immediate: your account stays as it is for 7 days, and cancelling within that window puts everything back. We email you when the countdown starts, and Settings can stop it at any point before the date. To start it you give your password and type your email address exactly.

Before you get that far, the page tells you what happens either way.

What stays behind. Your tasks, time and files in workspaces you share with other people stay where they are, listed under a deleted user, so your colleagues keep their records. The page counts them for you.

What goes. Your name, email address, profile picture, sign-in history and every personal setting. Any workspace where you're the only member goes with the account, and the page names those workspaces before you agree to anything. You won't be able to sign in again.

Two things stop a deletion before it starts, and the page names them:

  • You own a workspace other people are still working in. Remove them, or delete the workspace, first. Deleting your account can't take away somebody else's work behind their back.
  • You have a live subscription. Cancel it first, so the billing stops with the account. See Your subscription.

If you want a copy of your work before it goes, take one first: Settings → Data → Download your data for your account, and Download this workspace for the work itself. See Exporting your work.