Account security and two-step sign in

src/content/docs/account.mdx

@@ -1,6 +1,6 @@
 ---
 title: Your account
-description: Change your profile, theme, time zone and currency, subscribe to your calendar feed, sign out, or delete your account.
+description: Change your profile, language, theme, time zone and currency, your email and password, turn on two-step sign in, subscribe to your calendar feed, sign out, or delete your account.
 ---
 
 import { Steps } from '@astrojs/starlight/components'
@@ -17,10 +17,13 @@ Everything about you lives on **Me**: your profile, your preferences, and, in th
 
 - **Change photo** to upload a new picture (PNG, JPG, WebP or GIF, up to 5 MB). Potluck crops it square.
 - **Display name** is how friends see you on shared tabs and plans. Edit it and tap **Save**.
-- **Email** is the address you sign in with.
+- **Email** is the address you sign in with. To change it, see [Change your email](#change-your-email).
 
 ## Preferences
 
+**Language**
+: Pick **English**, **Español**, **Français**, **Deutsch** or **Português**. The app switches right away, no reload needed. Your choice is saved to your account, so it follows you to your other devices and is still there after you sign out and back in. Anything not translated yet shows in English.
+
 **Time zone**
 : Every time in Potluck shows in this zone. If your device is somewhere else (say you are traveling), a **Use my current time zone** button appears.
 
@@ -32,6 +35,108 @@ Everything about you lives on **Me**: your profile, your preferences, and, in th
 
 Changes save as soon as you make them.
 
+## Sign in and security
+
+This part of **Me** holds your email, your password, two-step sign in and your devices.
+
+### Change your email
+
+<Steps>
+
+1. Under **Sign in and security**, next to **Email**, tap **Change email**.
+2. Type your **New email** and tap **Send confirmation links**.
+3. Open the link we sent to your **old** address, and the one we sent to your **new** address. Either order works.
+
+</Steps>
+
+Nothing changes until both are confirmed. That way, someone who gets hold of your phone cannot quietly move your account to their inbox. Until then, **Me** says it is waiting for you to confirm from both inboxes. Once you open one link, Potluck reminds you to open the other.
+
+**Cancel a pending change**
+: Changed your mind, or made a typo? Tap **Cancel the change** under the waiting message. Both links stop working and your email stays as it was.
+
+### Change your password
+
+<Steps>
+
+1. Under **Sign in and security**, next to **Password**, tap **Change password**.
+2. Type your **Current password**.
+3. Type your **New password** (at least 8 characters), then type it again.
+4. Tap **Save password**.
+
+</Steps>
+
+If you signed in more than a day ago, Potluck also emails you a 6-digit code to check it is really you. Enter the **Code from the email** and tap **Save password** again.
+
+Once it is saved, your other devices are signed out. The one you are using stays signed in.
+
+**Forgot your password?**
+: Tap **Forgot it?** next to **Current password**. It opens **Reset your password** with your email filled in. Tap **Send reset link** and pick a new password from the email. This also works if you have only ever signed in with emailed sign-in links and never had a password.
+
+**Set a password**
+: If you only ever signed in with Google or Apple, the button says **Set a password** instead. There is no current password to type, so just pick a new one. After that, you can sign in with your email and password too.
+
+### Sign out everywhere
+
+Lost a phone, or signed in on a shared computer? Next to **Devices**, tap **Sign out everywhere** and confirm. Every phone, tablet and browser on your account has to sign in again, including the one you are using.
+
+## Two-step sign in
+
+Two-step sign in adds a second check. After your password, sign-in link, or Google or Apple, Potluck asks for a 6-digit code from an authenticator app on your phone. Someone who learns your password still cannot get in without it.
+
+### Set it up
+
+You need an authenticator app, like 1Password, Google Authenticator or Authy.
+
+<Steps>
+
+1. Under **Sign in and security**, next to **Two-step sign in**, tap **Set up**.
+2. Scan the QR code with your authenticator app. Cannot scan it? Tap **Copy key** and type or paste the key into the app instead.
+3. Enter the 6-digit code the app shows and tap **Turn on**.
+4. Save your recovery codes (see below), then tap **I saved them**.
+
+</Steps>
+
+**Me** now shows **On**, the date you turned it on, and how many recovery codes you have left.
+
+### Recovery codes
+
+When you turn on two-step sign in, Potluck shows you ten recovery codes. They are your way back in if you lose your phone. Tap **Copy codes** or **Download**, and keep them somewhere safe, like a password manager.
+
+:::caution[You only see them once]
+The codes are shown when you set up, and never again. The window only closes when you tap **I saved them**.
+:::
+
+Each code works once. Running low, or worried someone saw them? Tap **New recovery codes** and confirm. Your old codes stop working right away, and you get a fresh set of ten to save.
+
+### Sign in with a code
+
+When you sign in, Potluck shows **One more step**. Open your authenticator app, enter the 6-digit code for Potluck, and tap **Verify**.
+
+Signed in to the wrong account? Tap **Use another account** to go back to **Sign in**.
+
+### Lost your phone
+
+<Steps>
+
+1. Sign in as usual. On **One more step**, tap **Use a recovery code**.
+2. Enter one of the codes you saved and tap **Verify**.
+
+</Steps>
+
+You are in, and two-step sign in is now **off**, so you can set it up again on your new phone. Do that from **Me** right away. Your old recovery codes stop working.
+
+You get five tries every 15 minutes. After that, wait 15 minutes and try again.
+
+Potluck also sends you a notice, **Two-step sign in is off**, to your inbox and devices, and to your email once email notifications are on. If you did not use a recovery code, someone else has your password and one of your codes: [change your password](#change-your-password) now and set up two-step sign in again.
+
+:::note[No phone and no codes?]
+Potluck cannot let you in on its own. Open an issue on [GitHub](https://github.com/Fermulate/potluck/issues), but leave out your email and any codes. Someone will check it is really you before turning two-step sign in off by hand.
+:::
+
+### Turn it off
+
+Next to **Two-step sign in**, tap **Turn off**. Enter a code from your authenticator app and tap **Turn off**. Asking for a fresh code means a borrowed, unlocked phone is not enough. Your recovery codes are deleted too.
+
 ## Notifications
 
 **Open inbox** takes you to your notifications. **Push notifications** turns pings on or off for this device.
@@ -61,7 +166,7 @@ Anyone with your feed link can see your plans' titles, times, places and group n
 
 ## Sign out
 
-Tap **Sign out** at the bottom of **Me**. You are signed out on this device only.
+Tap **Sign out** at the bottom of **Me**. You are signed out on this device only. To sign out on all of them, see [Sign out everywhere](#sign-out-everywhere).
 
 ## Delete your account
 

src/content/docs/notifications.mdx

@@ -38,8 +38,9 @@ New updates are under **New**, older ones under **Earlier**. Tap one to go strai
 | **Are you in?** | About a day before a plan | People who have not answered | Reminders |
 | **New comment** | Someone comments | People in that expense, or the organizer and people coming to that plan | Comments |
 | **Your month in Potluck** | The first of each month | You, if you owe or are owed money | Monthly summary |
+| **Two-step sign in is off** | A [recovery code](/account/#lost-your-phone) turns off two-step sign in | You | None, it always arrives |
 
-You never get notified about your own actions.
+You never get notified about your own actions, except **Two-step sign in is off**, in case it was not you.
 
 ## What to hear about
 
@@ -108,7 +109,7 @@ If push does not arrive, see [Troubleshooting](/troubleshooting/#push-notificati
 
 ## Unsubscribe from emails
 
-Every Potluck notification email has an unsubscribe link. Some links stop one kind of email, like comments. Others stop all notification emails from Potluck. You do not need to sign in to use them. Sign-in links and password reset emails are not notifications, so they keep arriving when you ask for them.
+Every Potluck notification email has an unsubscribe link. Some links stop one kind of email, like comments. Others stop all notification emails from Potluck. You do not need to sign in to use them. Sign-in links and password reset emails are not notifications, so they keep arriving when you ask for them. [Security emails](/privacy-and-security/#security-emails) always arrive too.
 
 If your mail app shows its own **Unsubscribe** button next to the sender, tapping it works in one go.
 

src/content/docs/privacy-and-security.mdx

@@ -1,6 +1,6 @@
 ---
 title: Privacy and security
-description: What Potluck stores about you, who can see it, and what leaves the app.
+description: What Potluck stores about you, who can see it, how two-step sign in and security emails protect you, and what leaves the app.
 ---
 
 Potluck is free software with no ads and no tracking code. It stores what it needs to split money and plan things, and shows it only to the people you share a group with.
@@ -10,6 +10,7 @@ Potluck is free software with no ads and no tracking code. It stores what it nee
 | What | Who can see it |
 | --- | --- |
 | Your email and password | Nobody in the app. Your password is stored scrambled (hashed), never as text. |
+| Your two-step sign in key and recovery codes | Nobody in the app. Recovery codes are stored scrambled too. |
 | Your name, photo, time zone and default currency | You, and people you share a group with |
 | Groups, members and roles | The members of that group |
 | Expenses, splits, payments and comments | The members of that group |
@@ -20,6 +21,24 @@ Potluck is free software with no ads and no tracking code. It stores what it nee
 
 Someone who leaves a group, or is removed, loses access to it right away.
 
+## Two-step sign in protects everything
+
+With [two-step sign in](/account/#two-step-sign-in) on, a password or sign-in link alone gets nobody into your account. Until the code from your authenticator app is in, Potluck shows and changes nothing: no groups, no expenses, no plans, no live updates, and no files, like receipts. Your email, password and two-step settings cannot be changed either.
+
+This is checked by Potluck's servers, not just the app, so it holds even against someone who skips the app and talks to the servers directly.
+
+## Security emails
+
+Potluck emails you when:
+
+- your password changes,
+- your email changes,
+- two-step sign in is turned on or off.
+
+If a recovery code turns two-step sign in off, you also get a **Two-step sign in is off** notice in your inbox and on your devices, and by email once email notifications are on.
+
+These always arrive. They have no setting on **Me** and no unsubscribe link, and unsubscribing from other emails does not stop them. If one surprises you, [change your password](/account/#change-your-password) right away.
+
 ## Things worth knowing
 
 - **Profile photos** are stored at a link that is hard to guess but not secret. Anyone who has seen the link can open the photo.
@@ -31,7 +50,7 @@ Someone who leaves a group, or is removed, loses access to it right away.
 
 - **Push notifications** pass through your browser maker's push service (Google, Mozilla or Apple). They are encrypted for your device, so that service cannot read them.
 - **Exchange rates** are fetched from a public source of reference rates. Nothing about you is sent.
-- **Emails** for sign-in links and password resets are sent by Potluck's email provider. Once email notifications are on, so are the notification emails you get. Unlike push, they are not encrypted for your device: they carry the update itself, like an expense, payment, comment or your balances, and your mail service and the email provider can read them. To stop them, turn off the **Email** switches on **Me** (see [What to hear about](/notifications/#what-to-hear-about)).
+- **Emails** for sign-in links, password resets, email changes and [security alerts](#security-emails) are sent by Potluck's email provider. Once email notifications are on, so are the notification emails you get. Unlike push, they are not encrypted for your device: they carry the update itself, like an expense, payment, comment or your balances, and your mail service and the email provider can read them. To stop them, turn off the **Email** switches on **Me** (see [What to hear about](/notifications/#what-to-hear-about)).
 - **Calendar files** you download, and Google Calendar links you open, contain the plan's details. That copy is yours to manage.
 
 ## Deleting your data