This policy covers a lost authenticator app and lost recovery codes.
Sign in credentials
You sign in with your email address. The second step is an authenticator app that shows a six digit code.
The setup issues recovery codes with the authenticator app. Each recovery code works once. A recovery code replaces the authenticator app at sign in.
Store the recovery codes outside the phone.
Lost phone, recovery codes held
- Sign in with a recovery code.
- Open the security page.
- Set up the authenticator app again.
Lost recovery codes, phone held
- Sign in with the authenticator app.
- Open the security page.
- Remove the authenticator app.
- Set up the authenticator app again.
The setup issues new recovery codes.
Lost authenticator app and lost recovery codes
We do not restore the account. The sign in provider holds the authenticator secret and the recovery codes. We hold neither. No evidence restores access.
Open a new account with the same email address. The new account starts empty.
Requests we refuse
We never ask for a recovery code. We never ask for the code the authenticator app shows. We never send a link that signs you in. Treat a message that asks for one of these as an attack.
A recovery request
File a recovery request on the request form. Give your email address. Describe what happened.
- A request records a support case.
- A request grants no access.
- A request changes no session, no password, and no authenticator app.
- We reply to the address you give.
- We set no reply time.
- We answer the same way for every address.
- The form never states whether an account exists.
Policy versions
We record the policy version you confirm before the authenticator app setup. A new version carries a new date and asks for a new confirmation.