Sign-in & sessions

How sign-in works

• Enter your email and choose Email me a code.
• The email has a 6-digit code and a sign-in link. Use either one.
• The code works for 15 minutes, once, with up to 5 tries.
• The link opens a page with a Sign in button, so email security scanners that open links can’t use up your code.
• Signing in with a new email creates your account.

Continue with Google or Apple

Where they’re switched on, the sign-in page also offers Continue with Google and Continue with Apple. The email code always works too.

• The first time, we use the email Google or Apple confirms for you. If no account has it yet, a new account is made.
• If an account already has that email, we link it straight away only when Google or Apple actually runs the address: a Gmail address, a Google Workspace address on its own domain, or Apple’s private relay. For any other email we send that address a sign-in code first, and link only once the code is entered, so nobody gets into your account just by putting your email on their own Google or Apple account.
• An email the provider hasn’t verified never signs anyone in.
• After that, your Google or Apple account signs you in by its own id, even if its email changes.
• With Apple’s Hide my email, your login email is the private relay address Apple gives us.
• Each sign-in is protected against forged or replayed responses (a one-time state and nonce, and PKCE with Google).

Limits that stop guessing

Past a limit, you’re asked to try again in an hour.

The sign-in page and the start of a new web chat can also ask for a quick, usually invisible check that you’re a person, not a script (Cloudflare Turnstile), where it’s switched on.

Sessions

• You stay signed in for 30 days on each device, then sign in again.
• Sign out ends the session on that device only.
• Sign out on all devices, in your account menu, ends every session you have — use it if you lost a phone or signed in on a shared computer.
• When someone is removed from your team, they lose access immediately — on every device.
• If you belong to more than one business, switch between them from the sidebar.

Behind the scenes

• Codes and session keys are stored only in scrambled (hashed) form, so a copy of our database can’t be used to sign in.
• Session cookies can’t be read by scripts on the page, and are only sent over secure connections.
• Access is checked by role on every request, not just in the menus.
• Tornaly staff who can open the platform admin area must also use two-step verification with an authenticator app.
• Old sign-in codes and sessions are deleted automatically. See Your data.

New businesses

A new business may be reviewed by our team before it goes public: until it’s approved (usually within a day), its public links and the AI front desk’s replies stay off, and a banner says so. Each person can run one business.