Signing In and Account Security

Feedpik accounts are keyed to an email address, however you sign in. That matters more than it sounds: signing in with Google and later setting a password gives you two ways into one account, not two accounts.

The ways in

Email and password. The ordinary route.

A six-digit code. Feedpik emails you a code instead of asking for a password. It is valid for ten minutes and once only. Useful on a machine where you do not want to type a password, and the fastest route if you have forgotten one.

Google, and depending on how this deployment is configured, GitHub or Apple. The sign-in page shows what is actually available — a provider that has not been configured is not offered rather than failing after you click it.

Email verification

New accounts get a verification email. Until that link is followed, some things are held back — this is the check that stops an address being claimed by someone who cannot read it.

Verification links and sign-in codes both come from the same address. If they are not arriving, look in spam first; failing that, an address at a provider with aggressive filtering is worth swapping for another before assuming something is broken at this end.

Resetting a password

Forgot password on the sign-in page emails a reset link.

If it does not arrive, sign in with the six-digit code instead — same email, different mechanism, and it gets you in immediately. You can set a new password once inside.

What the bot check is doing

Sign-up, sign-in, password reset and code requests all sit behind a bot check. Most of the time it resolves without you doing anything.

It is there because those four endpoints are the ones worth attacking: an unguarded sign-in is a place to try leaked password lists, and an unguarded code request is a way to send email in someone else's name. If it visibly fails, a reload usually clears it; a browser blocking third-party scripts is the usual cause.

Keeping the account secure

Your session is a browser session. Log out from the avatar menu when you are on a machine that is not yours — closing the tab is not the same thing.

Access keys are separate from your login. An agent holding a key cannot change your password, issue itself another key, or delete the account; those need a signed-in session. Review keys and their last-used dates in Agents & Access.

The audit log records who did what, distinguishing your own changes from an agent's. It is the first place to look when something changed and you did not change it.

If you think something is wrong

Do these in order. The first one is instant and total, and the rest can wait.

1. Revoke every access key in Agents & Access. This cuts off anything holding a token immediately.
2. Change your password, or set one if you have only ever used Google.
3. Read the audit log to see what was actually done.
4. Check your personas — a share you did not create is visible in Discover Sources under your own published items.

Revoking first is the point. Diagnosing takes time; cutting access does not.

If something looks wrong

No email arrives, of any kind — check spam, then try a different address. Sign-in codes and verification come from the same sender, so if neither arrives it is delivery rather than any one feature.

My code expired — ten minutes, once only. Request another; there is no limit on how many you can ask for.

I signed in with Google and now cannot find my data — check the email address matches the one you used before. Accounts are keyed to the address, so a Google account on a different address is a different account.

Sign-in says my account exists but I never made one — someone may have used your address at sign-up. It cannot be used without verification, so the safe move is a password reset, which proves you control the address.

I want to delete everything — Your data and privacy covers the export and the deletion, in that order.