Signing in

Your account is how you reach your business’s records, so how you sign in matters. There are several ways in, and you can use more than one.

Create an account

Sign up with an email address and a password, and you create a business at the same time — your account is tied to that business from the start.

You have to confirm your email address before you can sign in: the link in the email works once and lasts 24 hours, and the sign-in page offers to send another, once every five minutes. That is what stops somebody signing up with an address they do not own and receiving mail meant for whoever does.

Signing up with an address that already has an account makes nothing new, and the page reads the same as it would for a new one: the address gets an email saying somebody tried, with the way to sign in — so nobody can learn from the sign-up page who has an account.

Sign in the way that suits you

Three ways in, all equally valid:

• Email and password.
• Google, Microsoft or Apple — if your business already runs on one of those, or you keep everything on your iPhone, this is one fewer password to keep.
• A passkey — your face or your fingerprint. See Passkeys.

The first time you sign in with Google or Microsoft using an address you already have an account under, the two are connected only if Google or Microsoft confirms the address is yours: a personal Microsoft account, a work account on a domain your organization has verified with Microsoft, or a Google address Google has verified. If it can’t confirm it, sign in the way you usually do, then connect Google or Microsoft from your Security page. The same goes for starting a new business with Google or Microsoft — though an invitation to join a team still works, because the invitation’s own link proves the address is yours.

Sign in with Apple works the same way, and Apple always confirms the address it sends. If you choose Hide My Email, your account is made under the private address Apple gives SMG Tools, ending in privaterelay.appleid.com: our emails to it — the address confirmation and every notice — arrive in your own inbox through Apple. Your Apple ID connects to an account you already have only if you share your real address with Apple; a hidden one starts a new account, so to use Apple with an existing account, connect it from your Security page instead.

Add a second factor

A sign-in with your password always has a second step: a 6-digit code emailed to you, good for 10 minutes. That stays on. Tick Remember this device for 30 days when you enter it, and that device skips the code from then on. A passkey sign-in asks for no code — the passkey is both steps.

Under Two-factor authentication on your Security page you can add more:

• Turn on an authenticator app — scan the QR code with an app such as Google Authenticator or Microsoft Authenticator and enter the code it shows. A password sign-in then lets you use the app’s code instead of waiting for an email.
• Turn on for every sign-in, under Email authentication (Turn on email codes on an account with no password) — a Google, Microsoft or Apple sign-in then asks for an emailed code too. Either method makes those sign-ins ask for a code once it is on — the app’s, or the emailed one; with neither, they ask for no code.

The first method you turn on gives you ten recovery codes, shown once. Save them: each signs you in once if you lose your phone or cannot get the email.

It is worth doing. The records behind this login include your clients’ addresses, your pricing and your bank connections.

An owner can also require it across the business — see Keeping the account secure.

Reset a password you have forgotten

Forgot password on the sign-in page sends a reset link to your email address. The link works once and expires. Setting the new password signs you out everywhere else — every phone, tablet and browser that was signed in has to sign in again — so if you reset because you think someone else got in, they are out. Using the link also confirms your email address, if you had not yet.

If you signed up with Google, Microsoft or Apple, keep signing in the same way — or use the link to give the account a password as well.

Five wrong passwords in a row lock the account for fifteen minutes, whichever way you then try to sign in — a password, Google, Microsoft, Apple or a passkey. A reset unlocks it.

What happens to your password

Passwords are stored hashed, using a slow, salted algorithm designed for the purpose. Nobody at SMG Tools can read your password, and a copy of the database does not hand anybody your login.

Delete your account

Your Security page has Delete my account at the bottom. After you confirm it’s you, it removes your sign-in — your password, passkeys, the Google, Microsoft or Apple account you linked (Apple is told to forget SMG Tools), every signed-in and remembered device, your notifications and your own preferences — and signs you out everywhere at once. It can’t be undone, and you’re emailed that it’s done.

What you recorded in the business you worked for — your time, notes and work — stays with that business, under your name, and its owner is told you left. You can make a new account with the same email address later.

If you own a business, you delete your account by handing the business over and choosing to leave, or by closing it — see hand the business to a new owner. Both are on Organization → Your data, where you can download a copy of everything first.