Accounts, projects, and your team

A CherrySub account identifies a person using the dashboard or CLI. A project owns team memberships and apps. Neither is the same identity as an end customer purchasing inside your app.

Sign up and verify email

Enter your first name, surname, email, and password. Passwords require uppercase and lowercase letters plus a special character. The form accepts 10–72 characters; the backend enforces a 72-byte upper bound, which matters for non-ASCII passwords.

Registration creates the account, its initial project, and a session, then requests a verification email. Dashboard operations require a verified email. Verification links expire after 24 hours by default; request a new link from the verification screen when needed. If delivery is unavailable, the screen reports that state rather than confirming an email was sent.

A verification link can be opened in a fresh browser. Sign in if necessary and continue to the original local page. The application does not accept an arbitrary external redirect as the continuation.

Create and select projects

Use Create project, enter its name, and continue into the new project. Its creator becomes the owner. Use the top project/app switcher to move between projects and apps. A URL from another project does not grant membership or silently move its data into your current project.

Changing projects replaces the active context. Finish or save form work before switching. Project settings display identity, team membership, invitations, and activity. Rename a project there when your role permits it.

Roles and permissions

Viewer settings show View access and disable configuration controls. Personal saved analyses and requester-private exports use their own account/project authorization; a disabled management button does not imply you cannot read or analyze data.

Invite a teammate

1. Open Project settings in the intended project.
2. Enter the teammate's email and select Admin or Viewer.
3. Send the invitation. The invited person opens the link and signs in or registers with the matching email.
4. After email verification, accept the invitation and enter the project.

Invitations expire after seven days. Pending invitations can be revoked, and an expired/revoked link requires a new invitation. A forwarded link does not let a different email accept membership. The API rejects direct member creation: membership must pass through invitation acceptance.

The current controls do not implement ownership transfer or self-service project deletion. Do not remove the owner by editing data directly.

Passwords and sessions

Account provides change-password and signed-in-device controls. Changing a password requires the current password and a different valid new password. The change flow retains the current session while revoking other sessions. Password reset is a separate email-token flow; reset links expire after 30 minutes and successful reset revokes existing sessions.

Use Forgot password when you cannot sign in. Its response avoids revealing whether another person's email has an account. A missing email is therefore not proof the account does not exist; check spelling, delivery, spam, and the latest reset link.

Sign out of this session, revoke a named session, or sign out everywhere as appropriate. Revoking the current session returns you to sign-in. Hosted sessions default to seven days; self-hosted operators can configure their lifetime. Session API.

Common recovery paths

• 403 / View access: verify the selected project and ask an owner/admin for the required role.
• Invitation belongs to another email: sign out and use the invited address.
• Expired session: sign in again; protected-page navigation preserves the local destination.
• Missing email: check the account address and email gateway availability before repeatedly resending.
• A shared chart will not open: the recipient still needs access to its project and app.