Your account works everywhere

One account is your key to everything here — every organization you join, every conversation, every purchase — and it stays yours as organizations come and go.

What your account is

Your handle (like @maya) is your name on the platform: it's how people mention you, invite you, and find your public page. It's yours across every organization — you never need a different identity per club, team, or association.
Your email is how you sign in and how the platform reaches you when you want it to. Verify it once and invitations sent to that address find you automatically. You can also sign in with Google or Microsoft — see below.
Your profile (photo, bio, links) is what others see — and you decide how much of it is public. That's its own story: Your profile is yours.

Sign in with Google or Microsoft

When the sign-in page shows Google or Microsoft buttons, you can use the account you already have there instead of a password.

New here? Press the button, then choose your handle on one short finish your account step — your name comes over from Google or Microsoft, already filled in.
Signing in with Microsoft still asks you to verify your email. We send a code to your address; type it in once. Microsoft doesn't tell us whether an address has been checked, so we check it ourselves.
Already have an account? Sign in with Google using the same email and we ask you to sign in to your existing account once — with your password — before connecting the two. That step is what stops anyone else from connecting their Google account to your account. After that, the Google button takes you straight in. Forgot that password? The same page sends a reset to your address, or lets you create a new account instead.
Landed on finish your account but already have one? Press Already have an account? Sign in to connect (it's there for Microsoft, and for Google when your account uses a different email). Sign in with your handle or email and password; from then on that button signs you straight in. No password on your account? Sign in with the button you normally use, then connect the new one from your account's security settings.
"Requires email verification" means your account's email isn't verified yet, so nothing new was connected. You're still signed in: verify your email, then connect from your account's security settings.
"Use this address as your email? Google verified it." You signed in to connect Google, and Google has a different address for you than your account does. Use it makes Google's address your verified email and connects Google; Cancel signs you in without connecting.
Your authenticator app still counts. If you've turned on multi-factor authentication, you're asked for your code after Google or Microsoft, just as after a password.

What connecting means. A connected Google or Microsoft account is one more way into the same Sessionata (dev) account — same handle, same organizations, same everything. Your Google or Microsoft password never reaches us. You can disconnect a sign-in method from your account's security settings, but you can't remove the only way into your account: add another one first.

What one account gets you

Membership in many organizations at once — join your gym, your league, and your side project without juggling logins (Belong to many, switch freely).
One inbox for everything — mentions, invitations, purchases, announcements — behind the bell (The bell).
One wallet — payment methods saved once work at every organization's checkout (Your payment methods).
Your conversations, portable — link the chat apps you already use on your Connected apps page (Chat from the apps you already love).

Security, plainly

Your password is held by a dedicated identity service — the product's pages never see it.
Passkeys work here — sign in with your device's fingerprint, face, or PIN instead of a password. Add one in your account's security settings; it's phishing-proof by design, because there's no password to steal.
You can review your active sessions and sign out everywhere from your account's security settings.
Multi-factor authentication is available in your account's security settings — five minutes of setup, and your account survives a leaked password.
Adding a sign-in method requires a verified email. Until your email is verified, you can't add a passkey, an authenticator app, or a connected Microsoft account — those controls show Requires email verification. Verify your email with the code we send, or connect Google, which verifies it for you. If Google has a different address for you, we ask before using it: Use it makes it your verified email, Cancel changes nothing. Removing a method always works.
Changing your password signs you out everywhere else. After a reset by email, every session on every device ends (Your password was changed — sign in again.), and you sign in again with your new password. Change it from your security settings instead and the browser you're using stays signed in; your other devices are signed out and can't get back in without the new password.
A verified email belongs to one account. Whoever verifies an address first keeps it. If you verify one that's already on another account, we tell you which (That address is already on @handle. Sign in there instead.) — you've just shown it's your mailbox. If someone else verifies an address your account only had unverified, your account loses it, and the next time you sign in we ask for a new one (Add your email) before you continue.
Signing up or changing your email to an address that already has an account? The page looks the same as always: check your inbox. The email you get says You already have a Sessionata (dev) account, @handle, with links to sign in or reset your password, instead of a code. If you meant to make a new account, use a different address. Nobody but the mailbox's owner ever learns whether an address has an account.
Changing a verified email? Your verified email stays yours until the new one is verified. We send a code to the new address; enter it on your account's Security page. Until then the new address shows as Pending, and you can send the code again or cancel. Once it's verified, the switch is made and we email your old address to say so (Your Sessionata (dev) email was changed to …).
Didn't change it? That email has a link: Wasn't you? Undo this change. It works once, for 7 days, and you don't need to be signed in. Choose a new password and your old email is back, verified. You're signed out everywhere else, and sign-in methods added since the change are removed. If we ask you to Review your sign-in methods, check the list on your Security page and remove anything you don't recognize.

Good habits

Verify your email early — it's the thread that ties invitations and receipts to you. Missed the first email? Your profile page has a Verify email button that resends it any time.
Set your handle thoughtfully; it's your public name in mentions and pages.
Turn on MFA. Genuinely. Five minutes.
Signing in with Google or Microsoft? Add a passkey too, so losing that account never locks you out of this one.

Did you know? All of your account settings — profile, security, sessions, payment methods, connected apps — live right here in Sessionata (dev); there's no separate account site to visit. And signing out here signs you out of Sessionata (dev) and the identity service together, so one "Sign out" means what it says.