Skip to content

Security

This page covers the security controls available to your account: password change, multi-factor authentication, OAuth app management, account deletion, and data export rights.

Password change

Open Settings → Security → Change password.

  1. Enter your current password
  2. Enter the new password twice (8–64 characters, must contain at least one letter and one digit)
  3. Click Update

After a successful change:

  • All existing sessions are signed out (you’ll need to log in again on every device)
  • All issued OAuth refresh tokens are revoked (re-authorize Claude Desktop / Cursor / Moraya)
  • API Keys are not affected — they continue to work; rotate them manually if compromised

Password reset (forgot password)

If you can’t sign in:

  1. Go to Sign in and click Forgot password
  2. Enter your email
  3. A 6-digit reset code arrives within 30 seconds (single-use, 5-minute expiry)
  4. Enter the code, then set the new password

Login security alerts

Picora automatically emails you when:

  • A new device / browser logs in successfully
  • 5 failed login attempts within 5 minutes from the same IP (account auto-locked for 15 minutes)
  • Password is changed
  • A new OAuth app is authorized

These alerts cannot be disabled.

Authorized OAuth apps (v0.14.0)

If you’ve connected Picora to AI tools via HTTP OAuth MCP, each authorization shows up under Settings → Authorized apps.

For each connection you can see:

  • App name (e.g., “Claude Desktop on MacBook Pro”)
  • Granted scopes (e.g., media:write, docs:read)
  • Last activity timestamp
  • IP address of last use

Click Revoke to invalidate that app’s tokens. The AI tool will be prompted to re-authorize next time it tries to access Picora.

Account deletion

To delete your account:

  1. Go to Settings → Security → Delete account
  2. Confirm the warning by typing DELETE (English) or 删除 (Chinese)
  3. Receive a 6-digit confirmation code by email
  4. Enter the code

Within 24 hours:

  • All your resources are deleted from object storage
  • Database rows are removed (user, identities, refresh tokens, API keys)
  • OAuth refresh tokens are revoked
  • Billing data is retained for 5 years (legal compliance), but de-identified

If you have an active subscription, cancel it first — deletion does not auto-refund. See Subscription management.

Data export

Picora supports your right to receive a copy of your data:

  1. Go to Settings → Security → Export my data
  2. A background job assembles a ZIP containing:
    • User profile JSON
    • All API Keys metadata (key hashes only — original tokens are not recoverable)
    • All resources (images, videos, audio, Markdown) with metadata
    • Billing history (last 5 years)
  3. You receive a download link by email when ready (typically within 24 hours)
  4. The download link expires in 7 days

The exported ZIP is suitable for migrating to another service or for personal archive.

Multi-factor authentication