Authentication

Authentication & Accounts

Complete guide to user accounts, authentication, profile management, and cloud synchronization in Cine Power Planner.

Table of Contents

• Overview
• Requirements
• Why Use an Account?
• Creating an Account
• Signing In
• Profile Management
• Password Management
• Account Security
  • Two-Factor Authentication
  • Passkeys
• Cloud Synchronization
• Managing Multiple Devices
• Account Deletion
• Privacy & Data
• Troubleshooting
• Related Documentation

---

Overview

Cine Power Planner works completely offline without an account. Creating an account is optional, and unlocks:

• Cross-device sync: Access your data on any device
• Cloud backup: Automatic backup to secure cloud storage
• Collaboration: Share projects with team members
• Real-time updates: Changes sync instantly across devices
• Two-factor authentication: optional TOTP + passkey second factor (see Two-Factor Authentication)

Key Point: The app is local-first. Your data always lives on your device first, and cloud sync is optional.

Requirements

Functional Requirements

Non-Functional Requirements

Data Requirements

• Credentials: Email + hashed password stored in Supabase Auth
• Profile: Display name, avatar URL, phone, address, company, role, bio, certifications, licences — stored in Supabase user metadata
• Session tokens: Stored in local storage, auto-refreshed
• Local data: IndexedDB stores remain untouched regardless of auth state

Constraints & Limits

• Available to all tiers (Free and Pro)
• Password reset link expires after 24 hours
• Profile picture max file size: 5 MB (JPG, PNG, GIF)
• Account deletion is immediate and irreversible — the cloud purge runs in the same request. There is no grace period and no undo.

Offline Behavior

• Core app functionality (local data, gear lists, tools) works without authentication
• Cloud sync, collaboration, and push notifications require signed-in state + network

Dependencies

• Requires: Supabase Backend — GoTrue auth service
• Required by: Projects (REQ-PRJ-012) — tier enforcement
• Required by: Collaboration (REQ-COL-001) — sharing requires accounts
• Required by: Sync — cloud sync depends on auth tokens

---

Why Use an Account?

Benefits of Cloud Sync

When to Use an Account

Recommended for:

• Working across multiple devices (phone, tablet, desktop)
• Production teams collaborating on projects
• Important projects requiring cloud backup
• Sharing gear lists with clients or vendors

Optional for:

• Single-device users
• Those preferring complete offline operation
• Temporary or test projects

---

Creating an Account

Step-by-Step Registration

1. Navigate to Settings:

   • Open the app
   • Click Settings in the sidebar
   • Go to User or Cloud Sync tab

2. Start Registration:

   • Click "Create Account" or "Sign Up"

3. Enter Your Information:

   • Email address: Valid email (required)
   • Password: Strong password (min 8 characters)
   • Confirm password: Re-enter password
   • Display name: How you'll appear to others (optional)

4. Agree to Terms:

   • Read the Terms of Service
   • Check "I agree" box
   • Review Privacy Policy

5. Complete Registration:

   • Click "Create Account"
   • Check your email for verification link
   • Click verification link (if required)

Password Requirements

Strong Password Tips:

• Minimum 8 characters (12+ recommended)
• Mix of uppercase and lowercase
• Include numbers
• Include special characters (!@#$%^&*)
• Avoid common words or personal info

Examples:

• ✅ "GearList2026!Prod"
• ✅ "C4m3r4-T3ch#G3ar"
• ❌ "password123"
• ❌ "12345678"

Email Verification

After registration:

1. Check your email inbox
2. Look for email from Cine Power Planner
3. Click the verification link
4. Return to app - you're now verified!

Didn't receive email?

• Check spam/junk folder
• Click "Resend verification"
• Verify email address is correct
• Wait a few minutes

---

Signing In

Sign In Process

1. Open Settings → Account
2. Click "Sign In"
3. Enter email and password
4. Click "Sign In"

Stay Signed In

Option: "Remember Me"

• Keeps you logged in across sessions
• Convenient for personal devices
• Skip sign-in on each visit

Security Note: Don't use on shared devices

Sign In on New Device

1. Install/open app on new device
2. Go to Settings → Account
3. Sign in with existing credentials
4. Wait for initial sync
5. Your data appears!

First Sync:

• May take a few minutes for large datasets
• Keep app open during sync
• Check sync status indicator

Sign Out

To sign out:

1. Go to Settings → Account
2. Click "Sign Out"
3. Confirm sign out

What Happens:

• Any edits still waiting to reach the cloud are given up to 5 seconds to finish uploading
• Cloud sync stops
• Local data remains on device
• Can continue working offline
• Sign back in anytime to resume sync

If some changes could not be uploaded in time, you are told how many and asked whether to sign out anyway. This matters only for a sign-out that also clears local data — otherwise those edits stay on the device and upload the next time you sign in to the same account. The 5 seconds is a hard limit: an upload that has not come back by then is left to finish on its own, so a slow or unreachable server can never leave the Sign Out button hanging.

---

Profile Management

Editing Your Profile

Access profile settings:

1. Go to Settings → Account
2. Click "Edit Profile"

Editable Fields:

• Display Name: Your public name
• Profile Picture: Upload photo
• Phone Number: Optional contact
• Address: Postal address
• Company: Organization name
• Role: Your job title
• Bio: Brief description
• Certifications: Professional certifications
• Licences: Relevant licences

Profile Picture

Uploading:

1. Click "Change Photo"
2. Select image file (JPG, PNG, GIF)
3. Crop image (optional)
4. Click "Save"

Requirements:

• Max file size: 5MB
• Recommended size: 400x400px
• Formats: JPG, PNG, GIF

Removing:

• Click "Remove Photo"
• Reverts to default avatar

Display Name vs Email

Display Name:

• Shows to collaborators
• Used in comments and mentions
• Can be changed anytime

Email:

• Login credential
• Used for notifications
• Requires verification to change

Profile Visibility

There is no public/private profile switch. This section described one until 2026-09-07. What is actually true is fixed behaviour, not a setting you choose:

• Your display name and profile picture are visible to collaborators on projects you share, and appear beside your chat messages, comment threads, and in the Sessions & Devices list.
• Your email, phone number and address are never shown to collaborators.

To change what other people see, change your display name or picture in Settings → Account → Profile.

---

Password Management

Changing Password

Steps:

1. Go to Settings → Account
2. Click "Change Password"
3. Enter current password
4. Enter new password
5. Confirm new password
6. Click "Update Password"

Best Practices:

• Change every 3-6 months
• Don't reuse old passwords
• Use unique password for this app
• Enable password manager

Forgot Password

Reset Process:

1. On sign-in screen, click "Forgot Password?"
2. Enter your email
3. Click "Send Reset Link"
4. Check email for reset link
5. Open the link in the same browser you requested it from (see below)
6. The app opens Settings → Security & Privacy → Password with the reset form already in recovery mode — it asks only for the new password, not your old one
7. Set the new password and sign in with it

Open the link in the same browser you requested it from. The reset link is bound to a one-time verifier stored by the browser that asked for it. Opening the mail on a different device or in a different browser cannot complete the exchange, and the app will say so and offer a fresh link. If you requested the reset on your phone, open the email on your phone.

Security:

• Link expires after 24 hours
• Old password stops working
• Active sessions may be logged out

Password Security

Tips:

• Use password manager (1Password, Bitwarden, etc.)
• Enable biometric login if available
• Don't share passwords
• Log out on shared devices
• Report suspicious activity

---

Account Security

Security Best Practices

Device Security:

• Lock your devices with PIN/password
• Enable biometric authentication
• Don't save passwords on shared computers
• Keep operating system updated

Account Security:

• Use strong, unique password
• Sign out of unused sessions
• Monitor account activity
• Report unauthorized access immediately

Network Security:

• Use secure Wi-Fi networks
• Avoid public Wi-Fi for sensitive operations
• Use VPN if needed
• Verify HTTPS connection

Two-Factor Authentication

Two-factor authentication is optional and off by default. Turning it on is the single biggest improvement you can make to this account's security, and this guide did not mention it at all until 2026-09-07.

Settings → Security & Privacy → Two-Factor Authentication

While it is off, the section reads "Two-factor authentication is off. Add an authenticator app to turn it on."

Add an authenticator app (TOTP):

1. Click "Add authenticator app"
2. Scan the QR code with your authenticator (1Password, Aegis, Google Authenticator, …)
3. Enter the 6-digit code to verify
4. Save your recovery codes — see below

Recovery codes. Enrolment issues a set of one-time recovery codes. They are how you get back in if you lose the authenticator, so store them somewhere other than the phone that generates the codes. You can issue a fresh set later with "Regenerate recovery codes", which asks for your password first; regenerating invalidates the previous set.

Removing a factor requires your password — the "Remove factor" button prompts for it.

Passkeys

A passkey can be added from the same section with "Add a passkey" → name it → "Register passkey", and your device will prompt for Touch ID, Windows Hello, a security key, or whatever it uses.

A passkey here is a second factor, not a way to sign in. You add one while already signed in, and it upgrades that session's assurance level. There is deliberately no "Sign in with a passkey" button on the sign-in form: the pinned Supabase auth SDK routes every WebAuthn call through an existing session, so a passkey cannot start one. If you were expecting passwordless sign-in, this is not that — you still sign in with your email and password, and the passkey satisfies the second step.

Where you will meet the second step. Once two-factor is on, sensitive actions ask for your authentication code as well as your password — deleting your account is one of them.

Session Management

Active Sessions:

View where you're signed in:

1. Go to Settings → Security & Privacy → Sessions & Devices
2. View "Active Sessions"
3. Each row shows the device, the browser, when it was last active, and a Current Session badge on the one you are using

No location is shown. This guide said the list included location until 2026-09-07. It never has — so an unfamiliar place is not something you can look for here. Judge a session by its device and browser, and revoke anything you do not recognise.

Revoke one session: click "Revoke" on its row.

Sign out everywhere:

1. Click "Sign Out Everywhere"
2. Confirm
3. Every session ends — including this one, so you will sign in again here too

Suspicious Activity

Signs of Compromise:

• Unknown devices in sessions
• Changes you didn't make
• Unusual sync activity
• Emails about changes you didn't request

What to Do:

1. Change password immediately
2. Sign out all devices
3. Check for unauthorized changes
4. Contact support if needed

---

Cloud Synchronization

How Sync Works

Local-First Architecture:

Your Device (Primary)
    ↓
IndexedDB (Local)
    ↓
Changes Made
    ↓
Queue for Sync (if online)
    ↓
Supabase (Cloud Mirror)

Key Principles:

• Device is always the source of truth
• Changes sync when online
• Offline changes queue automatically
• Conflict resolution available

Sync Status

Status Indicators:

Location:

• The sidebar, under your profile (when signed in)
• Settings → Security & Privacy → Sessions & Devices, as a read-only Sync status row

There is no Cloud Sync tab, no "Sync Now" button and no sync options. This guide described all three until 2026-09-08. Sync runs automatically whenever you are signed in and online — there is nothing to switch on, no auto-sync / Wi-Fi-only / background-sync choice, and no manual trigger. The only sync control in Settings is Reset Sync (see below), which is destructive.

When Sync Looks Stuck

1. Check the status in the sidebar — Offline means the queue is waiting for a connection, not that anything was lost
2. Reload the app; the queue drains on the next successful pass
3. Only if the status stays Sync Error across reloads, use Settings → Backup & Data → Sync → Reset Sync. It clears local sync metadata and baselines, and can cause temporary duplication if conflicts exist at that moment

Conflict Resolution

When Conflicts Occur:

Same item edited on multiple devices before sync

Resolution Options — the buttons the wizard actually shows:

1. Keep All Local: this device's version overwrites the cloud version completely
2. Accept All Cloud: the cloud version overwrites your local changes completely
3. Review Field by Field: pick a side per field, keeping both versions' work
4. Skip This Conflict: leave it queued and decide later

Access: the conflict wizard opens by itself as soon as a conflict is detected — there is no badge to click and no settings page listing a conflict queue. See Conflict Resolution.

---

Managing Multiple Devices

Adding a New Device

1. Install App:

   • Download on new device
   • Open app

2. Sign In:

   • Go to Settings → Account
   • Sign in with existing account

3. Wait for Sync:

   • Initial sync may take time
   • Depends on data size
   • Keep app open

4. Verify Data:

   • Check projects loaded
   • Verify contacts
   • Confirm settings

Tips:

• Use same account on all devices
• Ensure stable internet
• Be patient with initial sync

Device Management

View Connected Devices:

1. Go to Settings → Security & Privacy → Sessions & Devices
2. See list of devices using your account
3. View last sync time

Remove Device:

1. Find device in list
2. Click "Remove"
3. Device loses access to your data
4. Data remains on device locally

Sync Conflicts Between Devices

Preventing Conflicts:

• Sync before switching devices
• Avoid editing same project simultaneously
• Use presence indicators (if available)
• Communicate with team

Resolving Conflicts:

See Conflict Resolution above

---

Account Deletion

Before You Delete

What Happens:

• Account permanently removed
• Cloud data deleted
• Local data remains on devices
• Cannot be undone

Recommendations:

• Export full backup first
• Notify collaborators
• Complete pending syncs
• Cancel any subscriptions (if applicable)

How to Delete

1. Go to Settings → Security & Privacy → Danger Zone
2. Find "Delete Account"
3. Click "Delete My Account"
4. Enter your password
5. If two-factor authentication is on, also enter your authentication code
6. Confirm — the account and all cloud data are deleted immediately

Timeframe:

• Immediate. delete-account runs purgeUserCloudData(…, { keepAuthUser: false }) and then admin.deleteUser in the same request. There is no grace period, no "disabled" holding state, and no way to undo it. The confirmation dialog says "This action cannot be undone" — believe it.
• Local data: unaffected. Your IndexedDB stores stay on the device and the app keeps working offline.

⚠️ This guide promised a 30-day retention window before the cloud purge until 2026-09-07. That was never true, and it was the most costly error in this document: it invited people to delete an account believing they could still change their mind.

Retaining Your Data

Before Deletion:

1. Export Full Backup:

   • Settings → Backup & Data → Backup → Download full backup
   • Save the .zip somewhere safe — it is named cine-power-planner-backup-YYYY-MM-DD.zip and holds the JSON plus your stored images

2. Export PDFs:

   • Export all project PDFs
   • Save to local storage

3. Document Contacts:

   • Export contacts to CSV
   • Save vendor information

After Deletion:

• Local data still accessible
• Continue using offline
• No cloud features

---

Privacy & Data

What Data is Stored

Cloud Data (if account enabled):

• Projects and gear lists
• Device library
• Contacts
• Templates
• Settings
• Profile information

Local Only:

• Cache files
• Temporary data
• Session information

Never Stored:

• Passwords (hashed only)
• Payment information
• Browsing history
• Personal files

Data Security

Encryption:

• Data encrypted in transit (HTTPS/TLS)
• Data encrypted at rest
• Secure authentication tokens

Access Control:

• Row-Level Security (RLS) policies
• Only you can access your data
• Shared data only with explicit permission

Backups:

• Regular server-side backup snapshots
• Your own Download full backup (a .zip) is the copy you control, and the one to take before anything destructive

The backend is a self-hosted Supabase instance on a single server, not a multi-region managed service. This guide claimed "geographic redundancy" until 2026-09-07; it does not apply to this deployment, and keeping your own downloaded backup matters more because of that.

Privacy Settings

Control Your Data — Settings → Security & Privacy → Privacy & Legal:

• Download my personal data — exports everything the account holds, for your records or to take elsewhere.
• Anonymize — strips personal details from your contracts, invoices and quotes while keeping the documents themselves. The dialog reports how many of each it changed.

⚠️ This guide listed three settings here until 2026-09-07 — Profile visibility, Activity sharing and an Analytics opt in/out — at a screen called "Settings → Privacy". None of the three has ever existed, and neither has that screen. That mattered more than a wrong label: a reader could believe they had opted out of analytics on a toggle that was never built. The two controls above are the real ones, and they are the more useful pair.

Third-Party Access

We Don't:

• Sell your data
• Share with advertisers
• Access your data without permission
• Use data for AI training

We Do:

• Use secure cloud infrastructure (Supabase)
• Follow data protection regulations
• Allow data export anytime
• Support account deletion

---

Troubleshooting

Can't Create Account

Issues & Solutions:

Can't Sign In

Common Problems:

"Invalid credentials"

• Check email spelling
• Verify Caps Lock is off
• Try forgot password

"Account not verified"

• Check email for verification link
• Click link to verify
• Resend if needed

"Network error"

• Check internet connection
• Try different network
• Wait and retry

"Account disabled"

• Contact support
• May be temporary
• Check email for explanation

Sync Issues

Sync Not Working:

1. Check internet connection
2. Verify signed in
3. Check sync status
4. Try manual sync
5. Sign out and back in

Sync Stuck:

1. Wait 5 minutes
2. Check data size (large datasets take time)
3. Try manual sync
4. Restart app
5. Sign out/in

Data Not Appearing on Other Device:

1. Ensure both devices signed in to same account
2. Check sync status on source device
3. Wait for sync to complete
4. Pull to refresh on destination
5. Check network connection

Profile Issues

Photo Won't Upload:

• Check file size (max 5MB)
• Verify format (JPG, PNG, GIF)
• Try different image
• Check internet connection

Name Won't Save:

• Check character limit
• Avoid special characters
• Save and refresh

Changes Not Syncing:

• Check sync status
• Force manual sync
• Sign out and back in

Account Recovery

Lost Access to Email:

• Update email in settings (if accessible)
• Contact support for assistance
• Provide proof of ownership

Forgot Password and No Email Access:

• Contact support
• May require identity verification
• Account recovery process

---

Related Documentation

• Sync Architecture - Technical details of cloud sync
• Collaboration - Working with team members
• Data Storage - Local and cloud storage
• FAQ - Common questions about accounts

---

← Back to User Guide | Next: Collaboration →

Last Updated: 2026-09-08 Version: 0.790.2