Account, team and privacy

Everything on this page lives in the dashboard, under Settings. The public API (/v1) uses API keys, which belong to a project, not to a person.

Signing in#

There are two ways, and both lead to the same account when the email is the same:

• Google: the "Continue with Google" button.
• Email link: type your email and click "Email me a sign-in link". The link works for 15 minutes and only once. It opens a page that asks for a click on "Sign in": automatic email scanners that open links by themselves cannot sign in for you.

If the email has no account yet, one is created on the first sign-in, like with Google, and you continue to the Welcome screen. The screen always answers the same, whether the email has an account or not. Too many requests from the same email or IP wait a few minutes.

With two-step verification on, the app code is still asked after Google or the link.

Two-step verification#

Under Settings > Security, turn on the 6-digit code from an authenticator app and keep the 10 recovery codes. Each person on the team turns on their own.

Team and roles#

Under Settings > Team, invite people by email and pick their role. There is no per-person pricing.

The rule applies to every dashboard route: an action outside the role answers 403 with the insufficient_role code.

Invitations#

• The person gets an email from Couryo with the invitation link. It works for 7 days, once.
• To accept, they sign in with the same email as the invitation (Google or email link).
• You can resend it (the old link stops working and the 7 days start again) and revoke it.
• Each person is in one account at a time. Someone already in another account as developer, admin or viewer leaves it when accepting. Someone who owns an account with no use (no domain, email sent or contact) has that account closed when accepting; if the account is in use, they transfer its ownership or delete it first.
• The ceiling is 50 people per account, counting pending invitations, the same on every plan (member_limit_reached). An account sends at most 30 invitations a day.

Removing, leaving and transferring the ownership#

• Admins and the owner change the role of other people and remove them. Nobody changes their own role.
• A removed person leaves right away: their sessions end and the apps they connected through MCP stop. API keys belong to the project and keep working: revoke the ones they knew.
• Anyone except the owner can leave the team.
• Transfer the ownership: the owner picks another person on the team, who becomes the owner; the former owner stays as admin. With two-step verification on, the code is asked. The account is never left without an owner (last_owner).

Level 0 (sandbox)#

On level 0, the account only sends to its own addresses: the emails of the people on the team. Someone who accepted the invitation counts; a pending invitation does not.

Account activity#

Under Settings > Activity (admins and the owner), the list of what happened in the account, newest first, with who did it, when and from which IP:

• dashboard sign-ins (Google or link);
• invitations, acceptances, role changes, removals, people leaving and ownership transfers;
• API keys created and revoked;
• domains added and removed (from the dashboard, the API or MCP) and the Cloudflare connection;
• projects created and deleted;
• requests to export the data and to delete the account.

The activity is kept for 12 months.

Exporting the data#

Under Settings > Privacy, admins and the owner ask for a ZIP file with the account data (data portability):

• the account, the team with their roles and the pending invitations;
• projects, API keys (name and prefix only, never the key), domains with their DNS records, receiving domains, webhooks (without the secret) and connected apps;
• templates with every version, contacts (with their topics) and their events, subscription topics, CSV imports (counters, report and the consent record; the CSV file is not kept), sequences and enrollments, campaigns and their recipients, suppressions;
• sent emails with their event timeline, within the plan's log retention (attachments only with name and size), and received emails;
• the account activity.

The file is built in the background. When it is ready, whoever asked gets an email with the download link. The link is signed and works for 72 hours; after that the file is deleted. Up to 3 requests a day. Secrets are left out: private DKIM keys, webhook secrets, tokens and two-step verification codes.

Deleting the account#

Also under Settings > Privacy, only the owner, by typing the account name (and the two-step verification code when it is on).

When you ask:

1. The subscription stops renewing: it lasts until the end of the period already paid and is not charged again.
2. API keys, connected apps, sending (campaigns and sequences included) and dashboard changes stop; the dashboard stays open to read, export and cancel. Calls with a key get account_pending_deletion.
3. There are 7 days of grace. Until then the owner cancels under Settings > Privacy and everything works again. The subscription keeps not renewing until you reactivate it under Billing.

After the 7 days, Couryo deletes domains (which leave the sending engine and Couryo's DNS zone), keys, webhooks, templates, contacts, topics, imports, sequences, campaigns, suppressions, emails and events, received emails, DMARC reports and the team, and sends the confirmation to the owner. Only what the law requires stays: billing records (with the company identification, when there was a payment), the record of the terms acceptance and the activity without names or emails, deleted within 6 months. Database backups expire within 30 days. Details in the Privacy policy.

After the deletion, the same email can start a new, empty account.