# Account, team and privacy

> How to sign in to the Couryo dashboard (Google or an email link), invite your team with roles, see the account activity, export the data and delete the account.

Source: https://couryo.com/en/docs/account

Everything on this page lives in the dashboard, under **Settings**. The public API (`/v1`) uses [API keys](https://couryo.com/en/docs/authentication.md), which belong to a project, not to a person.

## Signing in

There are two ways, and both lead to the same account when the email is the same:

- **Google:** the "Continue with Google" button.
- **Email link:** type your email and click "Email me a sign-in link". The link works for **15 minutes** and **only once**. It opens a page that asks for a click on "Sign in": automatic email scanners that open links by themselves cannot sign in for you.

If the email has no account yet, one is created on the first sign-in, like with Google, and you continue to the Welcome screen. The screen always answers the same, whether the email has an account or not. Too many requests from the same email or IP wait a few minutes.

With [two-step verification](#two-step-verification) on, the app code is still asked after Google or the link.

### Two-step verification

Under **Settings > Security**, turn on the 6-digit code from an authenticator app and keep the 10 recovery codes. Each person on the team turns on their own.

## Team and roles

Under **Settings > Team**, invite people by email and pick their role. **There is no per-person pricing.**

| Role | Can |
|---|---|
| Owner | everything, including billing, deleting the account and transferring ownership. There is always exactly one |
| Admin | everything except billing and deleting the account: team, projects, account settings, activity and data export |
| Developer | API keys, domains, templates, sending, webhooks, suppressions, contacts, sequences, campaigns and inbound |
| Viewer | read only |

The rule applies to every dashboard route: an action outside the role answers `403` with the [`insufficient_role`](https://couryo.com/en/docs/errors.md#insufficient_role) code.

### Invitations

- The person gets an email from Couryo with the invitation link. It works for **7 days**, once.
- To accept, they sign in **with the same email** as the invitation (Google or email link).
- You can **resend** it (the old link stops working and the 7 days start again) and **revoke** it.
- Each person is in one account at a time. Someone already in another account as developer, admin or viewer leaves it when accepting. Someone who owns an account with no use (no domain, email sent or contact) has that account closed when accepting; if the account is in use, they transfer its ownership or delete it first.
- The ceiling is **50 people per account**, counting pending invitations, the same on every plan ([`member_limit_reached`](https://couryo.com/en/docs/errors.md#member_limit_reached)). An account sends at most 30 invitations a day.

### Removing, leaving and transferring the ownership

- Admins and the owner change the role of other people and remove them. Nobody changes their own role.
- A removed person leaves right away: their sessions end and the apps they connected through [MCP](https://couryo.com/en/docs/mcp.md) stop. API keys belong to the project and keep working: revoke the ones they knew.
- Anyone except the owner can **leave the team**.
- **Transfer the ownership:** the owner picks another person on the team, who becomes the owner; the former owner stays as admin. With two-step verification on, the code is asked. The account is never left without an owner ([`last_owner`](https://couryo.com/en/docs/errors.md#last_owner)).

### Level 0 (sandbox)

On [level 0](https://couryo.com/en/docs/limits.md), the account only sends to its own addresses: the emails of the people on the team. Someone who accepted the invitation counts; a pending invitation does not.

## Account activity

Under **Settings > Activity** (admins and the owner), the list of what happened in the account, newest first, with who did it, when and from which IP:

- dashboard sign-ins (Google or link);
- invitations, acceptances, role changes, removals, people leaving and ownership transfers;
- API keys created and revoked;
- domains added and removed (from the dashboard, the API or MCP) and the Cloudflare connection;
- projects created and deleted;
- requests to export the data and to delete the account.

The activity is kept for 12 months.

## Exporting the data

Under **Settings > Privacy**, admins and the owner ask for a ZIP file with the account data (data portability):

- the account, the team with their roles and the pending invitations;
- projects, API keys (name and prefix only, never the key), domains with their DNS records, receiving domains, webhooks (without the secret) and connected apps;
- templates with every version, contacts (with their topics) and their events, subscription topics, CSV imports (counters, report and the consent record; the CSV file is not kept), sequences and enrollments, campaigns and their recipients, suppressions;
- sent emails with their event timeline, within the [plan's log retention](https://couryo.com/en/docs/limits.md) (attachments only with name and size), and received emails;
- the account activity.

The file is built in the background. When it is ready, whoever asked gets an email with the download link. The link is signed and works for **72 hours**; after that the file is deleted. Up to 3 requests a day. Secrets are left out: private DKIM keys, webhook secrets, tokens and two-step verification codes.

## Deleting the account

Also under **Settings > Privacy**, only the owner, by typing the account name (and the two-step verification code when it is on).

When you ask:

1. The **subscription stops renewing**: it lasts until the end of the period already paid and is not charged again.
2. API keys, connected apps, sending (campaigns and sequences included) and dashboard changes **stop**; the dashboard stays open to read, export and cancel. Calls with a key get [`account_pending_deletion`](https://couryo.com/en/docs/errors.md#account_pending_deletion).
3. There are **7 days of grace**. Until then the owner cancels under Settings > Privacy and everything works again. The subscription keeps not renewing until you reactivate it under Billing.

After the 7 days, Couryo deletes domains (which leave the sending engine and Couryo's DNS zone), keys, webhooks, templates, contacts, topics, imports, sequences, campaigns, suppressions, emails and events, received emails, DMARC reports and the team, and sends the confirmation to the owner. Only what the law requires stays: billing records (with the company identification, when there was a payment), the record of the terms acceptance and the activity without names or emails, deleted within 6 months. Database backups expire within 30 days. Details in the [Privacy policy](https://couryo.com/en/privacy).

After the deletion, the same email can start a new, empty account.