# Account Settings

Manage your personal account settings, profile, and security preferences.

## Profile Information

### Update Your Name

1. Navigate to **Profile** from the user menu
2. In the **Profile Information** section, update your name
3. Click **Save**

### Update Your Email

1. Go to **Profile**
2. In the **Profile Information** section, enter your new email
3. Click **Save**
4. Verify your new email address via the confirmation email

**Note**: Your old email will remain active until you verify the new one.

### Profile Photo

Upload a profile photo to personalize your account:

1. Go to **Profile**
2. Click **Select A New Photo**
3. Choose an image from your computer
4. Click **Save**

Supported formats: JPG, PNG, GIF (max 2MB)

## Security Settings

### Change Password

Update your password regularly for security:

1. Navigate to **Profile**
2. Go to the **Update Password** section
3. Enter your current password
4. Enter your new password
5. Confirm your new password
6. Click **Save**

**Password Requirements**:
- Minimum 8 characters
- At least one uppercase letter
- At least one lowercase letter
- At least one number
- At least one special character recommended

### Two-Factor Authentication (2FA)

Add an extra layer of security to your account:

#### Enable 2FA

1. Go to **Profile**
2. Find the **Two Factor Authentication** section
3. Click **Enable**
4. Scan the QR code with your authenticator app:
   - Google Authenticator
   - Authy
   - 1Password
   - LastPass Authenticator
5. Enter the 6-digit code from your app
6. Click **Confirm**
7. **Save your recovery codes** in a safe place

#### Recovery Codes

Recovery codes let you access your account if you lose your phone:

- Each code can be used once
- Store them securely (password manager recommended)
- Generate new codes if you use them all
- Keep them offline for maximum security

#### Disable 2FA

1. Go to **Profile**
2. Find the **Two Factor Authentication** section
3. Click **Disable**
4. Confirm with your password

### Passkeys

Passkeys (WebAuthn) let you sign in without a password, using your device's biometrics or a security key:

1. Go to **Profile**
2. Find the **Passkeys** section
3. Click **Add Passkey** and follow your browser or device prompt
4. Give the passkey a recognizable name (e.g., "MacBook Touch ID", "YubiKey")

You can register several passkeys and remove any you no longer use. Passkeys work alongside your password and two-factor authentication.

### Connected Accounts (Google & GitHub)

Sign in with your Google or GitHub account instead of a password:

- Use **Sign in with Google** or **Sign in with GitHub** on the login and registration pages
- Link or unlink these providers from your **Profile** at any time
- If an account link ever gets out of sync, it repairs itself automatically the next time you sign in

### Browser Sessions

Manage active sessions across all your devices:

#### View Active Sessions

See where you're logged in:
- Device type (Desktop, Mobile, Tablet)
- IP address
- Last active time
- Current session marked

#### Log Out Other Sessions

If you suspect unauthorized access:

1. Go to **Profile**
2. Find the **Browser Sessions** section
3. Click **Log Out Other Browser Sessions**
4. Enter your password
5. Click **Log Out Other Browser Sessions**

This logs you out from all other devices but keeps your current session active.

### Session Security

Control how long you stay signed in when you step away:

1. Go to **Profile** > **Session Security**
2. Choose your idle timeout: **24 hours** (the default) or **3 hours**
3. Pick the shorter 3-hour window on shared or less-trusted devices for tighter security

Your session clock resets with every action, so you're only signed out after genuine inactivity. Leave it on the default and your sessions behave exactly as before.

## API Tokens

Manage API tokens for programmatic access:

### Create an API Token

1. Navigate to **API Tokens** from the user menu
2. Click **Create API Token**
3. Enter a descriptive name (e.g., "CI/CD Pipeline", "Mobile App")
4. Select permissions:
   - **Read**: View resources
   - **Create**: Create new resources
   - **Update**: Modify existing resources
   - **Delete**: Remove resources
5. Choose the token's scope:
   - **This project only** (default): the token can only touch resources in your current project
   - **All my projects**: account-wide access across every project you belong to
6. Click **Create**
7. **Copy your token immediately** - it won't be shown again!

> New tokens default to **This project only**, and each token shows its scope in the list. A project-locked token is refused with a clear message if used against any other project. Existing tokens keep their account-wide access unless you recreate them.

### Token Security

- Treat tokens like passwords
- Never commit tokens to version control
- Use environment variables
- Rotate tokens regularly
- Delete unused tokens

### Revoke a Token

1. Go to **API Tokens**
2. Click **Delete** next to the token
3. Confirm deletion

The token becomes invalid immediately.

## Notification Preferences

Choose which notifications you receive, and whether they arrive by **email**, **in-app** (the Notification Center), or both. Preferences save per category:

- **Account Activity**: Password changes and profile updates
- **Security**: New sign-in alerts and suspicious-activity alerts (see below)
- **Billing**: Invoices, receipts, payment failures, budget alerts
- **Service Alerts**: Maintenance and incidents
- **Marketing**: Product updates, tips, newsletters

Update them:
1. Go to **Profile** > **Notification Preferences**
2. Toggle each category on or off, per channel
3. Click **Save**

### Sign-In Alerts

Get notified whenever your account signs in from a new device. Turn the email and in-app alerts on or off independently under **Notification Preferences**.

### Suspicious Activity Alerts

If we block a burst of failed sign-in attempts on your account, we alert you by email and in-app. Each alert names the IP address the attempts came from and confirms your account was not accessed. Repeated attempts from the same source are grouped, so a sustained attack won't flood your inbox. Control these with the **Suspicious Activity** toggle in **Notification Preferences**.

### Unsubscribe from Marketing

Click the unsubscribe link at the bottom of any marketing email.

**Note**: You'll still receive critical account and billing emails.

## Privacy & Data

### Data Export

Request a copy of your data:

1. Contact support via the dashboard
2. Request a data export
3. Receive a download link within 48 hours

Exported data includes:
- Account information
- Resource configurations
- Billing history
- Support tickets

### Account Deletion

**Warning**: This action is permanent and irreversible!

Before deleting your account:
1. Delete all resources
2. Download any needed data
3. Export invoices for records

To delete your account:
1. Go to **Profile** > **Delete Account**
2. If anything still blocks deletion (for example, active resources or an unpaid balance), you'll see exactly what to resolve first
3. Confirm with your password

Once the checks pass, your account and data are removed. We may ask for brief feedback on why you're leaving.

## Account Limits

View your current resource limits:

1. Navigate to **Account Limits**
2. View limits for:
   - VPS Instances
   - Database Instances
   - Cache Instances
   - Firewalls
   - SSH Keys
   - Snapshots

### Request Limit Increases

Need higher limits?

1. Go to **Account Limits**
2. Click **Request Increase**
3. Select the resource type
4. Enter desired limit
5. Provide justification
6. Click **Submit Request**

Requests are typically reviewed within 24-48 hours.

## Billing Information

Manage billing separately for each project:

- Payment methods
- Billing address
- Tax information
- Invoices

See [Billing & Payments](https://docs.danubedata.ro/billing-overview) for details.

## Account Security Best Practices

### Strong Authentication
1. Use a strong, unique password
2. Enable two-factor authentication
3. Use a password manager
4. Don't share your password

### Session Management
1. Log out from shared devices
2. Review active sessions regularly
3. Log out unused sessions
4. Use secure networks

### API Security
1. Use API tokens instead of passwords
2. Give minimum necessary permissions
3. Rotate tokens regularly
4. Monitor API usage
5. Revoke suspicious tokens

### Account Monitoring
1. Review account activity regularly
2. Check login notifications
3. Monitor resource changes
4. Review billing for unusual charges
5. Keep contact email current

## Troubleshooting

### Can't Log In

**Forgot password?**
1. Click **Forgot Password** on login page
2. Enter your email
3. Check your email for reset link
4. Create a new password

**Lost 2FA device?**
1. Click **Use Recovery Code** on 2FA page
2. Enter one of your recovery codes
3. Disable 2FA and re-enable with new device

**Account locked?**
- Too many failed login attempts lock accounts for 15 minutes
- Contact support if you need immediate access

### Email Not Received

Check:
1. Spam/junk folder
2. Email filters
3. Email address is correct
4. Wait a few minutes (delays can happen)

Still nothing? Contact support.

### Can't Enable 2FA

1. Ensure your device clock is synchronized
2. Try a different authenticator app
3. Clear browser cache
4. Try a different browser
5. Contact support if issues persist

## Support

Need help with your account?

- **Support tickets**: Through the dashboard — the fastest route
- **Email**: support@danubedata.ro

## Next Steps

- [Two-Factor Authentication Guide](https://docs.danubedata.ro/account-settings)
- [API Documentation](https://docs.danubedata.ro/api-authentication)
- [Billing Settings](https://docs.danubedata.ro/billing-overview)
- [Project Management](https://docs.danubedata.ro/account-projects)