Your account

Your identity, preferences and password; the tokens and connected apps that act as you; your data export; closing the account.

Last updated 2026-10-10

Open the user menu and choose Account settings. It has three tabs — Profile, MCP access and Runners & pools — and everything on them belongs to you alone. A project’s own settings are on Project settings.

Identity

Your username is your @handle — chosen at sign-up, or derived from your sign-in address — and it cannot be changed.
Display name is what is shown next to your work — tasks, comments, pages. Up to 255 characters, on one line.
Email is your verified address. Change address asks for the new address and your current password, then sends a code to each address — Confirm change takes both. An account without a verified address gets Add an email address instead, with one code.

Preferences

Theme (light, dark or the system’s), UI language (English, Japanese, Vietnamese, Korean) and Content language — which translation of a page or task you see, Same as UI language by default; it does not affect what you create. Each change saves as you make it, to your account, so it follows you to every device.

Password and sessions

Change password takes the current one and a new one of at least eight characters and at most 72 bytes. Your other sessions sign out; this one stays; MCP tokens, connected apps and linked sign-ins are untouched.
Forgot it? Reset it by email sends a code to your verified address. A reset signs you out everywhere else and disconnects connected apps.
Log out everywhere ends every session, this one included, and revokes every connected app. Tick Also revoke my MCP tokens to end those too. There is no list of sessions to end one at a time.
Linked sign-ins lists the single sign-on providers linked to your account — Google, on app.rindo.io — with Link and Unlink; both need your current password, and unlinking ends your other sessions. An account that has only ever signed in with Google knows no password: set one with Reset it by email first, and the password-guarded acts — linking, unlinking, changing the address, closing by password — open up.

If someone else may have been in your account, the section gives the order that matters: change your password before you unlink a sign-in you do not recognise, unlink it before you revoke your tokens, and check the address after. It also names what the page cannot reach — runner tokens, the provider’s own settings. When in doubt, ask an instance admin to lock the account.

Security events

A table of the security-relevant changes to your account, newest first: password changes and resets, log-outs everywhere, sign-ins linked and unlinked, tokens created and revoked, connected apps authorized and revoked, address changes, locks, closure. Each row says when, what, whether you or an instance admin did it, and through which channel.

Tokens and connected apps

The MCP access tab is where MCP clients get their credentials; Connect your assistant walks through the clients.

Create token makes a personal access token. Read-only lets it change nothing; Scope — Full access, your permission level live, or a chosen set of capabilities — narrows it separately, and when both are set both apply. No scope includes project settings, deletion or the other acts the web app keeps to itself, and a scoped token cannot create or revoke tokens, change your password or create projects. Set Expires to no expiry, thirty days, ninety days or a year. The token starts rnd_ and is shown once; tokens have no names, so the table tells them apart by scope and dates, and flags one unused for thirty days. Revoke takes effect at once. An account holds a limited number of live tokens; revoked and expired ones do not count.
A token acts as you, with your permissions as they are now — a change to your permission in a project applies to it the moment it is made.
Connect an MCP client carries a snippet for each client: Claude Code, Cursor, VS Code, Codex CLI, or a generic one; the Claude web and desktop entry has none, because Claude signs in through the browser and needs no token.
Connected apps lists the apps you authorized through browser sign-in — their access level, when they connected and when they were last used. Revoke cuts an app off at once; you reconnect from the app itself.

Runner pools

The Runners & pools tab lists the runner pools you own. New pool creates one; in a pool you Register runner (its credential is shown once, and the runner needs rindo-runner 1.1 or later with a container engine on a Linux host) and Mint pool token for a provisioner, at most two live at a time. Granted to lists the projects a project Admin has granted the pool to — a pool serves only projects where you are an Owner or an Admin. Retiring a pool or a runner is final. The runner itself is described in Run your own runner.

Ownership offers

When a project’s Owner — or, in a handover the operator runs, the operator — offers you ownership, the offer appears at the top of your Profile until it expires. Accept makes you the Owner: the project moves onto your account, counts toward your active projects unless it is archived, and its storage counts toward your limits; the previous Owner becomes an Admin. Decline closes the offer. No e-mail is sent about an offer, so this section is where you find it; accepting needs a verified address.

Export your data

Export my data builds an archive of your account’s own data: your profile and preferences, memberships, token metadata (never the secrets), connected apps, linked sign-ins, offers, pins, saved filters, watches and runner pools; your security events; and, for every project you can still read, the comments, revisions and uploads you authored, with the files. It is built in the background. Download works for up to seven days — a newer export replaces it — and each click makes a link that lasts ten minutes; leave a project the file carries, or see it go to the Trash, and you export again. Download before you close the account; from the request on, no link can be made.

Notifications

Notifications are the in-app Inbox only — there is no e-mail or chat delivery. The events are fixed: assigned and unassigned, @mentioned, a reply to your comment, a draft awaiting your approval, changes to what you watch, and an agent job of yours that expired or was cancelled. From the Inbox you can mute a project; @mentions still come through. There are no per-event preferences.

Terms

When the terms of service change, the next page load asks you to Accept and continue before anything else.

Close your account

Close account… is at the foot of Profile. Confirm it with your current password, or switch to Confirm with an emailed code instead and Email me a code.

It is refused while you own a project that is neither archived nor deleted. A refused attempt also offers each such project to one eligible member, unless an offer you made there is still pending — so hand projects over, archive them or delete them first. Once it goes through: every session, every token, connected app and runner credential you created, and the runners and pool tokens of your pools end, with any job running on them; invitations and ownership offers you sent are withdrawn; an export still being built is cancelled; your teammates see Deleted user where your name was.

For fourteen days, signing in with your password — or with an emailed sign-in code — cancels the closure; Google sign-in never does, and no sign-in does while the account is locked, though an instance admin can still cancel it. After that the account is anonymised in place: the handle is reserved for good, the address, name, password and linked sign-ins are removed, and what you wrote stays in its projects under an anonymous id. That step is not reversible.