An account is you: an email or a social profile, a password, two-factor protection. Membership in a venue is your role in one particular café.
One account can belong to several venues at once with different roles: owner in your own place, waiter next door. So the password belongs to the account, and the permissions belong to the membership.
Three doors into the same place: email and password, Google and Zalo. You pick the way when you sign up, and you use the same one from then on.
{info} An account created through Google or Zalo has no password at all — there will be no password card in the security settings. That's normal: you sign in again with the same button.
When you sign up by email you have to confirm the address — the message arrives right away, and its link opens on any device (you can sign up on a computer and confirm from a phone).
If the message isn't there: check the Spam folder and ask for it to be sent again on the same screen.
{info} A plain sign-up doesn't ask for a name — it is taken from the address. The exception is signing up through a personal invitation: the name is already filled in by the owner and can't be changed (invitations).
To change your own password — Settings → Security. The minimum length is eight characters.
Forgot password? — the link on the sign-in page: enter your email and a reset link comes to you. The answer is always the same ("If that email is registered, a reset link is on its way") — it can't tell you whether an account with that address exists.
{info} The old password is never stored in readable form and can't be recovered — it can only be replaced with a new one.
A second step at sign-in: besides the password, a six-digit code from an authenticator app. Any standard one will do, there is no separate Qreaty app to install.
The order: Settings → Security → Enable 2FA, confirm it's you, scan the QR code (or enter the key manually if the camera can't read it), enter the code from the app.
{warning} Until the code is entered and the activation is confirmed, the protection is not on — an unfinished setup will not block your sign-in.
With 2FA on, the code screen opens after the password. If the phone is lost, the same screen has a link to enter a recovery code.
Right after 2FA is switched on the system shows eight recovery codes — once. Each one works a single time and replaces the code from the app when the phone isn't at hand.
You can regenerate them at any moment (this asks you to confirm it's you), but then the old set stops working.
{warning} Keep the codes somewhere other than the phone with the authenticator on it: otherwise losing the phone loses both factors at once and there's nothing left to sign in with. Print them and put them in the cash drawer.
{info} Moving the authenticator to a new phone = turn 2FA off and on again: the old QR code is not shown a second time.
Before risky actions the app asks you to confirm that it's you: turning 2FA on and off, regenerating recovery codes, deleting a venue.
You can confirm with your password, a code from the authenticator or a code by email — only the ways your account actually has are shown. The code from the message is valid for ten minutes and works once.
{info} A Google or Zalo account has no password, so the email code and the authenticator are what remains. If the account's email isn't a real one, turn 2FA on in advance — otherwise there will be nothing to confirm with.
The owner does this from the member's card — and it is not the same as changing your own password: the owner enters neither the old nor the new password, the system issues a temporary one.
The temporary password is shown once — copy it and hand it to the member, who will then change it to their own. The reset immediately signs the person out on every device.
This is only offered for someone who works at your venue and nowhere else, and who is not an owner. The reason is the one this page opens with: a password belongs to the account, not to the membership. If the person also works somewhere else, a temporary password from you would open that place too — so the button becomes "Send reset link" instead: the email goes to the member, they choose the new password, and you never see it.
{info} A member who signs in through a social provider has no reset item — there is nothing to reset, they simply sign in again with the same button. To close their access, remove them from the team (staff). For a shared tablet the same action is called "Unpair device" (kiosk).