Accounts & Sync

An account is what lets you open the app on a second machine and find your work there. It is a small amount of server state, not a copy of your data warehouse.

Creating one

Sign in with a magic link (a single-use link valid for 15 minutes), with email and password, or with Google if the operator has enabled it. Passwords are verified with Argon2id; the link and the OAuth exchange are single-use and bound to the browser that requested them. Verification and deletion emails are transactional only — there is no marketing list.

What syncs

Synced (light records):

test records, with their drawings, journal entries and tags;
app and chart settings, watchlists, replay alerts;
dataset metadata — the description of a dataset, not its contents;
strategies and portfolio definitions.

Never synced:

candles and tick data. They stay in your browser's storage. They are re-downloadable from the data source you used, which is why copying them through a server would cost you bandwidth and buy you nothing.

Per-user soft caps apply to synced records; when one is reached, the app tells you instead of dropping records silently.

How conflicts resolve

Sync is last-write-wins per record, ordered by a server-assigned change sequence. There is no three-way merge and no merge-conflict dialog: the last committed write wins, and both devices converge to it. Keep that in mind if you edit the same test on two machines at the same time — the version with the later write is the one that survives.

Sessions are limited to three devices, with idle and absolute expiry; you can revoke a single session or all of them from settings.

Offline

The app is local-first: your datasets and tests open without waiting on a server, because they were never coming from one. When the link drops, the sync indicator reports offline, local writes are kept and marked dirty, and they are pushed on the next successful sync — an incoming remote change never overwrites a newer local edit that has not been pushed yet.

That is not an offline-mode promise. Cached files make reloads faster; nobody here claims the app starts with no network at all, and server features (cloud data browsing, billing, signing in on a new device) need the API.

Deleting your account

Deletion is requested from settings. Sessions and API keys are revoked immediately, and the account's server records are purged on a schedule after the request window. Deletion does not touch the data in your browser — that is yours to export or clear with Backup & Restore.