Account and security

1. 1
   Turn it on
   In Settings → Two-step verification, choose Turn on and confirm your password.
2. 2
   Connect your authenticator app
   Scan the QR code, or type the setup key (time-based, 6 digits, 30 seconds), then enter a code to confirm.
3. 3
   Save your backup codes
   Copy or download them and keep them somewhere safe. Each one works once, if your phone isn't at hand.

When you sign in, enter the code from your app, or choose Use a backup code. Tick Trust this device for 30 days on your own computer to be asked less often. You can make New backup codes or Turn off two-step verification in Settings.

• Use at least 10 characters. Longer is stronger; the strength meter tells you when it's good enough.
• Change it in Settings → Password. "Sign out my other devices" is on by default.
• For mailbox accounts it changes everywhere at once: the web and mail apps that use it (with two-step verification on, mail apps use app passwords instead). App passwords keep working unless you choose to revoke them; a reset with "Forgot password?" revokes them all.

Recovery email (accounts with an @exitomail.com address): add one in Settings → Recovery email and confirm it with the link we send (it works for 24 hours). Password reset links only go there, and only once it's confirmed. We also send billing emails and security notices there, and nothing else.

Forgot your password? Choose Forgot password? on the sign-in page. The reset link goes to your own address if you signed up with one, otherwise to your confirmed recovery email. It works for 30 minutes, and resetting signs you out on your other devices.

Settings → Sessions lists the browsers and devices signed in to your account. Sign one out, or Sign out others to end every session but this one. Sessions last 30 days while you use them; untick "Keep me signed in" on shared computers.

In Settings → Delete account, choose Delete my account…, confirm your password and choose Schedule deletion. Scheduling it also stops a paid plan from renewing.

• You have 30 days to change your mind: choose Keep my account in Settings. Mail keeps arriving until then.
• After 30 days we delete your mailbox and all mail, your app passwords, your Exito Vault files, your transfers and file requests, your domains and your account.
• Billing records we must keep by law are kept, separated from your account. Backups roll off within 30 days.

Questions about your data: privacy@exitomail.com. Anything else: support@exitomail.com.