# Accounts

How a Borago Board account works. Sign-up, sign-in, sessions, two-factor authentication, account recovery, the linked desktop, deletion, plans and every email.

An account is optional. The desktop app works without one, on its own machine, with every feature that runs there. An account exists for one thing. It turns on the cloud service, which keeps a copy of the board so a browser or a phone can open it, and which the desktop reaches through cloud sync and the relay. Signing in on the desktop never changes the local board. The encryption behind everything on this page is in [Security](/security/).

## What an account is for

| Surface | Without an account | With an account |
|---|---|---|
| Desktop app | Everything that runs on the machine. The board, the agent, containers, the terminal, scripts, flows, notes, local models, browser access on the local network | The same, plus cloud sync and the relay, once **Cloud sync** is turned on in Settings, then Account |
| Browser on the local network | Works. Login-free by design, off by default | Unchanged |
| Cloud browser at board.boragosoft.com | Not available | The board, signed in |
| Phone | Not available | The board in the phone's browser, signed in |

An account holds one board owner's work. Boards are single-user. A business account shares credentials and billing between members, never a board.

## Sign-up

Sign-up happens in the cloud browser or on the phone, never in the desktop app. It has three steps.

1. **Send verification code**. The email address receives a six-digit code. The code is valid for 15 minutes.
2. **Verify**. The code is entered.
3. **Create account**. A name and a password of at least 8 characters are set. The checkbox **I confirm I am 18 years of age or older** and the agreement to the Terms and the Privacy Policy must be ticked. The cloud service refuses the sign-up without the affirmation, so it cannot be skipped by any client.

A new account starts a free 30-day trial of the Max plan at once, with no card. An optional referral code can be entered on the last step. The desktop app itself has no age gate. Its only age affirmation is an 18 checkbox on each hosted provider's card, at the step where a Claude, OpenAI, Gemini or Grok API key is saved, because those providers set the requirement.

## Sign-in

| Where | How |
|---|---|
| Cloud browser and phone | Email and password. With two-factor authentication on, a second step asks for the code from the authenticator app |
| Desktop app | Settings, then Account, then **Cloud sync**. Either email and password with the same authenticator step, or **Sign in with your browser or phone instead** (described below) |

A password sign-in on the desktop also unlocks the account data key, which is what decrypts synced secrets on that machine. A code sign-in does not, which is the one difference between the two and is stated on both screens.

## Sessions

| Property | Value |
|---|---|
| Session length | 30 days |
| Renewal | Sliding. After half the session length has passed, every signed-in request receives a fresh session, and every client adopts it |
| Who signs in again | A device offline for more than half the session length may have to, and one offline for the whole session length always does |
| Password change | Ends every existing session at once, on every device |
| Where the session is kept | The browser and the phone keep it in local storage. The desktop keeps it in a file of its own, encrypted under a key the operating system's credential store protects, where there is one |

The desktop raises a notification when its cloud session has ended while nobody was at the machine, because sync and the relay stop with it.

## Two-factor authentication

| Property | Value |
|---|---|
| Method | Time-based codes from an authenticator app such as Google Authenticator, 1Password or Authy |
| Set up where | The cloud browser or the phone. Profile, then **Two-factor authentication**, then **Set up**. The desktop shows the state read-only |
| At sign-in | The password is checked first. Then a six-digit code, or a one-time recovery code, is required. No email is sent at sign-in |
| Recovery codes | Ten one-time codes shown once when set-up completes. Each works once. Only their hashes are stored |
| Code reuse | A code that has verified once is refused until its time window has passed |
| Turning it off | Profile, then **Two-factor authentication**, then **Disable**, confirmed with a current code or a recovery code |
| Where else it is asked | Disabling it, deleting the account immediately, and both password resets |

## Recovery email

An optional second address, set in Profile under **Recovery email** with **Add**, confirmed by a code sent to the new address, and password-gated. It is the way back in when both the authenticator and the recovery codes are lost. Security notices never go to it. A recovery email that equals the primary address is allowed, with a warning, because it then protects nothing.

## Recovery paths

| Situation | What it needs | What happens | How long |
|---|---|---|---|
| Forgot the password, no two-factor | The mailbox | **Forgot password?** on the sign-in screen sends a reset code. A new password is set and the session opens | The code is valid for 15 minutes |
| Forgot the password, two-factor on | The authenticator app or a recovery code | **Have an authenticator app? Reset without email** on the reset screen sets a new password against a code, with no email. The emailed reset also works, and it asks for an authenticator code as well, so the mailbox alone cannot take over the account | Immediate |
| Lost the authenticator and the recovery codes, recovery email set | The password and the recovery mailbox | **Can't access your authenticator?** on the code step sends a code to the recovery address. Confirming it schedules the removal of two-factor authentication and emails the primary address a notice with a cancel link. Signing in with the authenticator in the meantime cancels it too. When the hold ends, two-factor is removed, both addresses are told, and the existing password signs in | A 24-hour hold |
| Lost the password and the authenticator | The primary mailbox | **Lost your authenticator too?** on the reset screen starts a full recovery from the email address alone. The primary address receives a notice with a cancel link, and an owner signed in elsewhere sees a banner with a cancel button. When the hold ends, two-factor is removed and a password reset email is sent | A 24-hour hold |

The holds exist so that an owner is told, and has a day to say no, before any recovery takes effect. The desktop app never runs a recovery itself. Its **Forgot password?** and **Can't access your authenticator?** links open the cloud sign-in page in the browser, because every recovery ends in an email the desktop cannot receive.

## Security notices

A notice is emailed to the primary address, and only to it, whenever a credential changes. The three events are a password change (including a reset), two-factor authentication being turned on, and two-factor authentication being turned off (including removal by a recovery). The primary address is chosen so that an owner learns of a takeover even when the attacker changed the recovery email.

## Signing in the desktop from a browser or phone

The desktop can sign in without its password being typed there.

1. On the desktop, Settings, then Account, then **Cloud sync**, then **Sign in with your browser or phone instead**. The desktop shows a short code and a QR code, and opens the cloud sign-in page in the system browser.
2. In a browser or on a phone that is already signed in to the account, the approval screen appears. On the phone it can also be reached by scanning the QR code from the menu entry **Link desktop app**. The screen shows the desktop's name and the code.
3. The person checks that the code matches the one on the desktop's screen and presses **Approve** or **Deny**. Scanning never approves by itself.
4. The desktop, which keeps checking for the answer, receives its session exactly once.

| Property | Value |
|---|---|
| Direction | The desktop asks. A signed-in browser or phone approves |
| Code lifetime | 10 minutes, then the desktop says the request expired |
| What the code alone can do | Nothing. Approval needs a session that is already signed in, so the desktop inherits whatever protected that sign-in, two-factor authentication included |
| Secrets | The approving session never has the password, so synced secrets stay locked on that desktop until one password sign-in there. The desktop says so under the sign-in |
| A second desktop | The same takeover rule as a password sign-in, below |

## One linked desktop per account

| Rule | Detail |
|---|---|
| The link | The desktop sends a random installation id at sign-in. It is generated once per installation, is not derived from hardware or the operating system account, and survives signing out |
| One at a time | An account links one desktop. A browser and a phone never take part |
| A second desktop signs in | It is asked to confirm. The desktop wording is **Log out other desktop & link this one**. From the approval screen it is **Sign out other desktop & approve** |
| The replaced desktop | Its local board keeps working. Cloud sync and remote terminals stop, Settings says why, and a notification saying that cloud sync stopped because another desktop is now linked is raised once. Signing in there again takes the link back |
| What it changed while unlinked | Pushed to the cloud when it links back |

## Deleting the account

Profile, then **Delete account**, in the cloud browser or on the phone. The desktop profile is read-only. Three choices are offered.

| Choice | Reactivation window | Reminders | Confirmation | Billing |
|---|---|---|---|---|
| **Disable account** | 6 months | 30 days, 7 days, 48 hours and 24 hours before termination | One | Payments and cloud sync stop at once. No refund beyond the Refunds terms, and the remaining paid time is kept. Within the same billing cycle a return changes nothing. Later, the cycle restarts on the day of return |
| **Terminate account** | 14 days | 48 hours and 24 hours before termination | One | The same. A return within the window leaves the billing cycle unchanged |
| **Terminate and delete everything now** | None | None | Two, plus the password, plus a code from the authenticator app or, when two-factor authentication is off, a six-digit code emailed to the primary address | Payments and sync stop. No refund beyond the Refunds terms. Cloud credits are deleted with the data |

After a reactivation window closes the account is terminated, sign-in is disabled, and a final email is sent. The data is then held 14 more days, during which support can restore it, and then everything the account owns is deleted. That is the projects, tasks, comments, attachments and their stored files, the account itself, and its cloud credits. A final email confirms the deletion. The desktop's local board is never touched by any of this. Only sync stops. The immediate path always verifies the second factor, so nothing can reach the deletion without it. When two-factor authentication is off, the emailed code is also what tells an owner that someone holding the password tried.

## Plans

The desktop app is free. The cloud service has three paid plans, Basic, Pro and Max, which differ only in what they store. Amounts are on the [pricing page](/pricing/) and are shown again on the cloud board before anything is paid. Prices exclude tax, which is added at checkout where it applies.

| Plan | What it is |
|---|---|
| Basic | Cloud sync. The board in any browser and on the phone. Containers, terminals, scripts and chat from anywhere while the desktop is online. No file attachments on the cloud. Billed monthly |
| Pro | Basic, plus file and image attachments on the cloud and the transcripts of earlier runs on the cloud, the newest 100 per task. 10 GB of attachment storage. Billed monthly or yearly |
| Max | Pro with 40 GB of attachment storage, four times the room. Billed monthly or yearly. Extra storage can be added in blocks of 40 GB or 200 GB, up to 5 of each |

Storage add-ons are bought from the subscription on the cloud board, on a paid Max plan only, not during the trial. A block bills with the plan at the plan's billing period, is charged for the rest of the current period when it is added, and earns no loyalty discount. Removing a block credits the unused part against the next bill. Moving from Max to another plan ends the blocks, and the confirm says how much storage goes. The desktop app shows the blocks held and changes nothing.

No plan promises a support response time. Support is best effort for every account.

## The trial

| Step | What happens |
|---|---|
| Month 1 | A free 30-day trial of Max starts when the account is created. No card is asked for |
| Month 2 | Optional, once per account. One more month of Max for a single small payment, offered on the profile. Paying saves the card. Nothing renews from it |
| Month 3 | A plan the user chooses. With the saved card it is one tap, behind a confirm that names the price and the date of the charge. It starts when the paid month ends |
| Reminders | A notice 5 days before the free month ends offers the second month. Notices 7, 3 and 1 day before the second month ends, also by email, offer the plan |
| A plan bought during the trial | Starts, and is first billed, when the trial ends. Until then the account has Max, the trial's plan. Cancelling before the start leaves the trial as it was |
| The trial ends with no plan | Cloud sync and the cloud board close. The desktop app keeps working and nothing on it is lost. Attachments stored in the cloud are held for 90 days, as below |

## Billing rules

| Rule | Detail |
|---|---|
| Yearly billing | Pro and Max can be paid yearly at a discount. Basic is monthly only |
| Loyalty discount | Pro and Max earn a discount of up to 10% as a subscription's paid time grows. It is applied automatically, never removed while the subscription continues, and adds to the yearly discount. Basic earns none |
| A failed renewal | Sync keeps working for 30 days while the card is fixed. A banner says so. After that, sync and the cloud board close until the plan is renewed. No data is deleted for a payment failure |
| A failed first payment | After the trial, the account keeps the trial's plan for 7 days while the payment is collected. After that, sync and the cloud board close until it is |
| The price | A subscription keeps the price it was bought at. A change to the list price reaches new subscribers only |
| Storage | **Cloud storage** on the profile, and in **Settings**, then **Account** on the desktop, shows what is used and what is left. Notices arrive at 80, 90, 95 and 99% and when it is full |
| Storage at the limit | New uploads from the cloud browser or the phone are refused. A file added on the desktop stays on the desktop and is not saved to the cloud. Nothing already stored is deleted. Only files saved to the cloud count toward the limit, so a file kept on the desktop alone uses none of it |
| Moving to a plan with less room | When the files already stored are more than the new plan includes, the plan list and the confirm step say so before you choose. Nothing is deleted. New files are refused while the account is over the new limit |
| Moving to a plan without attachments | Attachments are either held for 90 days, with reminders 30 days, 2 days and 1 day before they are deleted and restored on a move to a plan with attachments, or deleted at once. The choice is asked at the change |
| Credits | A referral code on sign-up credits both accounts. Credits are deleted with the account |

## Business accounts

A business is one entity that several accounts belong to. It shares credentials and billing. It never shares a board.

| Concept | Detail |
|---|---|
| Guest | Joined by an emailed invitation, which is bound to that email and expires in 14 days. Keeps full ownership of the account, can leave at any time, and can remove a shared credential from its own use |
| Managed member | An account whose email is on a domain the business has verified. The business administers the membership, and the account cannot leave on its own |
| Roles | Owner, admin and member. The owner is never a managed member. Admins cannot remove admins |
| Verified domain | Proven by a DNS record on the domain. Never by a web page. Consumer email providers cannot be claimed. Verification is re-checked daily, and after 14 days of failed checks the management rights lapse |
| Claiming is never silent | When a domain is verified, every existing account on it receives an email saying that the account becomes a managed member 7 days later, and that moving to a personal email address before then avoids it |
| Shared credentials | A provider key shared by an admin is stored so that neither the cloud alone nor a member's machine alone can read it. Using one needs the cloud to be reachable. Revoking a member's access is immediate, and the app pairs it with a prompt to rotate the key at the provider, because a key already used cannot be un-learned |
| Where it is managed | The business page in the cloud browser. The desktop links a shared credential into a project and hands management off to the browser |

## Every email the service sends

The desktop app sends no email. Every email below is transactional or a security notice. There is no marketing email.

| Email | Why it is sent | To |
|---|---|---|
| Verify your Borago Board email | The first sign-up step | The address being registered |
| Reset your Borago Board password | **Forgot password?** was pressed | The account address |
| Confirm your Borago Board recovery email | A recovery email was added | The new recovery address |
| Your Borago Board account recovery code | A locked-out recovery was started with the password | The recovery address |
| Account recovery requested for your Borago Board account | The recovery code was confirmed and the 24-hour hold began. Carries the cancel link | The primary address |
| Your Borago Board account recovery is complete | The hold ended and two-factor authentication was removed | The primary and the recovery address |
| Full account recovery requested for your Borago Board account | Full recovery was started and its 24-hour hold began. Carries the cancel link | The primary address |
| Your Borago Board password was changed | A password change or reset | The primary address |
| Two-factor authentication was enabled | Set-up completed | The primary address |
| Two-factor authentication was disabled | Turned off by the owner, or removed by a recovery | The primary address |
| Confirm deleting your Borago Board account | The immediate delete passed the password step on an account without two-factor authentication | The account address |
| Your Borago account is disabled, or scheduled for termination | The account was disabled or terminated | The account address |
| Your Borago account is active again | The account was reactivated within its window | The account address |
| Your Borago account will be terminated in a stated number of days or hours | A reminder as the reactivation window nears its end | The account address |
| Your Borago account has been terminated | The window closed | The account address |
| Your Borago data has been deleted | The recovery hold ended and the data was deleted | The account address |
| Your Max month ends in a stated number of days, or tomorrow | 7, 3 and 1 day before the paid second month of the trial ends, when no plan is chosen yet | The account address |
| Your attachments are on hold | A move to a plan without attachments chose to hold them, or the trial ended with attachments stored and no plan bought | The account address |
| Your attachments are restored | A move to a plan with attachments before the hold ended | The account address |
| Your attachments will be deleted in a stated number of days or hours | A reminder as the hold nears its end | The account address |
| Your held attachments have been deleted | The hold ended | The account address |
| Your attachments have been deleted | Deletion was chosen at the move to a plan without attachments | The account address |
| You are invited to a named business on Borago Board | A business admin sent an invitation | The invited address |
| A named business has verified a domain on Borago Board | The domain of this account's email was verified by a business | Every account on that domain |

Related: [Security](/security/), [Cloud sync](/docs/reference/cloud-sync/), [The relay](/docs/reference/relay/), [Cloud sync, browser and phone](/docs/guides/cloud-sync-browser-and-phone/), [Set up two-factor sign-in and test the way back in](/docs/tutorials/two-factor-and-recovery/).