Getting your account back

Restore your account on a new phone, and protect it with a sign-in account.

On a new phone

Your account's key is not in your phone's backups. A new phone needs your 12 words or a sign-in account you linked, even an iPhone restored from a backup of your old one.

Install BeanPool and open it.
Tap Already a Member? Restore Account.
Choose Recover with 12 Words or Recover with Social.

With your 12 words

Type the 12 words in order, or tap Paste.
Under Which community?, tap Global community, or one of the communities this phone has had. For any other, tap another address and type your community's name or address.
Tap Recover Identity. Your name and photo come back from your community.

With a sign-in account

This works only if you linked one before (see below). BeanPool's key vault keeps the locked copy, and your sign-in finds it: you don't type your name or your community's address.

Tap Recover with and the account you linked: Google or Facebook, or Apple on an iPhone.
With Google on an iPhone, a Google web page opens. Sign in there and choose the account you linked. On Android, Google shows its own list of accounts. If it can't show one on that phone, a Google web page opens instead.
For your safety, getting back in with a sign-in waits a day. The app says when your account comes back. It checks by itself while it is open, and Check now asks straight away.
If you still have another phone with your account on it, open BeanPool there and tap Yes, it's me (see "If someone else tries"). Your account comes back within a minute.
When your account is back, choose the community to open it in. The global community is filled in; to use your own, type its name or address, or tap it under Your communities on this phone. Tap Continue. Your name and photo come back from that community.
Use my 12 words instead works any time, with no wait. Start again starts over with a sign-in.

If the app says Getting back in with a sign-in is paused for a little while, BeanPool's key vault has restarted and is waiting for the people who look after it to open it again. Nothing is lost: try again later. Your 12 words work any time.

If the key vault keeps no copy for that sign-in account, the app says so: your community may still keep one, from before the key vault (see "Moving a copy your community keeps"). Type your name in the community and your community's name or address, then sign in once more. That copy works only while your community's server is running.

If the sign-in account was linked from a phone that had your 12 words, on an up-to-date app, your 12 words come back too. Otherwise the phone has no 12 words: they can't be rebuilt from a sign-in. If you have them written down, you can add them (see "Your 12 words"). Until then a linked sign-in account is that phone's way back, so keep one linked, and link a second one if you can (see below).

Protecting your account now

Account Protection lists your ways back: Your 12 words first, then A sign-in you link, which says where its copy is kept before you link one. Who can open it under it says who can open that copy (see "Who can open the copy"). Where your account can be brought back from, under them, lists every copy and lets you remove them (see below).

Open Settings and tap Account Protection.
Under A sign-in you link, tap Protect with and choose an account.
Pass your phone's lock screen check. The linked account can bring your account back, so the app asks first.
With Google on an iPhone, a Google web page opens. Sign in there and choose your account, and you come back to BeanPool.

Safety Backup, when you join a community, says the same, under the same heading: where a sign-in you link there, or the one you joined with, keeps its copy.

Where the copy goes is your community's choice (see "Where your community keeps copies"). Most keep them at BeanPool's key vault. A community that keeps them on its own server says so under the sign-in buttons, and the copy goes there. A community that keeps none offers no sign-in to link: Your 12 words are your way back here.

One linked sign-in account covers all your communities: you don't link it again in each one. This works on a phone with no 12 words too.

If you joined the global community with 12 words, use Add a sign-in, near the top of Account Protection, instead. It is a way back too, and it also lifts the limits on a new 12-words account. See "Your 12 words".

If this phone has your 12 words, the linked account keeps them as well, so restoring with it gives them back. An account you linked on an older version of the app keeps only your key: tap Connect again next to it, and pass your phone's lock screen check, to include the words. On a phone with no 12 words there is nothing to include, so Connect again is not shown.

This is not a way to log in. Your account is still your own key. The linked account only helps you get it back.

If BeanPool's key vault is paused when you link an account, nothing is linked and the app says so. Settings then offers Link your (Google, Apple or Facebook) sign-in again, with Link it.
A sign-in account protects one BeanPool account. If it was protecting a different one, it protects this one now, and the app says so: that other account then has only its 12 words.
To remove it, tap Disconnect. The key vault deletes its copy at once, and from its backups within 30 days, or later if the vault is paused in that time.

Moving a copy your community keeps

Before the key vault, each community kept its own copy for the sign-in accounts linked there. If yours still keeps one, Settings shows Move your Google recovery to BeanPool's key vault (or Facebook, or Apple). Tap Move it, pass your phone's lock screen check and sign in once. The key vault gets a fresh copy, made on this phone, and your community's copy is then deleted. Not now puts the card away for a week.

If you'd rather not keep a copy anywhere, tap Remove it instead, then Remove it. Your community's copy is deleted and none is made at the key vault, so that sign-in account no longer brings your account back until you link it again. On a phone with no 12 words, the app warns you first: without them, and without a sign-in account, nothing brings your account back. If your community doesn't answer, the app says Not removed yet and tries again the next time you open Settings, and each time the app opens.

The other way round: where your community keeps copies on its own server, and the key vault has one for you that your community doesn't, Settings shows Keep your Google recovery with your community (or Facebook, or Apple). Tap Move it and sign in once: your community's server keeps a fresh copy, made on this phone, and the key vault then deletes its copy. Remove it instead deletes the key vault's copy and makes none. If the key vault doesn't answer, the new copy is kept and the old one stays: remove it in Where your account can be brought back from.

A move deletes the old copy only once the new one is kept where the move meant. If your community changed where it keeps copies since the card appeared, the move links nothing, your copy stays where it is, and the app says so.

Where your community keeps copies

Each community chooses where its members' copies go, and only its owners change it:

BeanPool's key vault, where every community starts. A sign-in you link keeps its copy at the key vault.
Its own server. A sign-in you link keeps its copy on your community's server instead, and the app doesn't ask the key vault for it. The app still asks the key vault whether it has a copy of your account, so it can offer to move one to your community (see above).
Nowhere. The community keeps no copies and doesn't use the key vault. The app offers no sign-in to link there, and your 12 words are your way back there. If you joined with 12 words, Add a sign-in is still offered, in the app and in a browser: it lifts the new-account limits, and keeps no copy. If you lose your phone and your 12 words, an admin can move your Beans and your name to a new key (see "Lost your phone and your 12 words").

In the app, a sign-in's copy goes only where the screen told you it would. If your community changed its choice since the screen last checked, nothing is linked, the app says so, and the screen then shows where a copy goes now.

A copy you already have is yours, wherever you made it: one key is a member of all your communities, and a copy made through one community also brings you back into the others. No community can remove it; you can, in Where your account can be brought back from.

When your community changes its choice, you're told in a notice from the community, and the next time you open the app a card on Home says what it means for you: See where my copies are opens Where your account can be brought back from, and where your community now keeps copies itself and the key vault has one of yours, Move mine opens Account Protection, where the move card above moves it. Nothing moves by itself.

An older version of the app doesn't know your community's choice: it keeps putting new copies where it always did. Update the app to follow it.

Where your account can be brought back from

In the phone app, open Settings, Account Protection, then Where your account can be brought back from. It lists every place a copy of your account is kept, as far as your phone can ask:

Your 12 words: whether this phone has them, and I have them written down, which you tick yourself. The app never checks it.
BeanPool's key vault: each sign-in account it keeps a copy for, and Kept since, the day that copy was made. Linking the same account again makes a new copy, with a new day. If you linked more than one account of the same sign-in (two Google accounts, say), each copy is listed under that sign-in, and its Remove takes them all: the key vault removes a sign-in's copies together. If the vault is paused or doesn't answer, the screen says so and lists nothing there.
Your communities' servers: each community on this phone, and the sign-in accounts its server keeps a copy for, from before the key vault, from the web app, or as a community's first owner. A community that doesn't answer is shown as not answering, and nothing there is listed.

Tap Remove next to a copy, or Remove everything under them all. A copy shows as removed only once the key vault or the community says it is gone:

The key vault deletes its copy at once, and from its backups within 30 days, or later if the vault is paused in that time.
A community's server deletes its copy. Copies already in that server's backups stay there (see "Who can open the copy").
If a community doesn't answer, the screen says Not removed yet, and the app tries again each time it opens. If you link that sign-in account there again in the meantime, the app leaves the new copy alone.
If a community couldn't be asked at all, Remove everything removes nothing there and says so. Open the screen again later.

Before you remove the last copy your phone knows of, the app asks Show my 12 words first?, unless you ticked I have them written down. On a phone with no 12 words, it says plainly what is left: if you lose the phone and have no 12 words written down, an admin can only move your Beans and your name to a new key (see "Lost your phone and your 12 words"). It never stops you.

Nothing is lost by removing a copy: to have that way back again, link the sign-in account in Account Protection (see "Protecting your account now"). In a community that keeps no copies, the screen says so in place of Link a sign-in: any copy it lists was made before, there or in another community, and is yours until you remove it.

In the web app, Settings has Where your account can be brought back from too. It lists whether that browser has your 12 words and the copies that community's server keeps, each with Remove. The web app can't reach the key vault, so it says Copies in BeanPool's key vault are managed in the phone app.

What the key vault keeps about you

For each sign-in account you link in the phone app, BeanPool's key vault keeps:

the locked copy of your key, with your 12 words if the phone had them, which only that sign-in opens;
two fingerprints, one of your sign-in account and one of your key, made with a secret only the running vault holds, so it can find your copy when your sign-in or your key asks;
the push addresses of your phones, locked with the copy, so it can tell them when someone starts getting back into your account;
the day the copy was made, and when it last brought your account back.

While someone is getting back in with a sign-in (see "If someone else tries"), it keeps the new phone's one-time key and the times, until 7 days after that ends. When you remove a copy, it keeps a note of the removal for 30 days, with the two fingerprints and the day, so that a restore from an older backup removes the copy again.

It never keeps your name, email, phone number or address, your sign-in account's id itself (only its fingerprint), which communities you are in, or a copy of what it handed back. It never writes down your IP address: to limit abuse, it counts the requests from each address in its memory, and forgets them when it restarts. The totals it signs each day count copies, restores and removals, and say nothing about anyone.

If you had linked GitHub

BeanPool no longer uses GitHub. A GitHub account's id is public, so a copy locked to it was not locked to anything only you have. When your community's server is updated, it deletes every copy linked to GitHub. Your account itself is not touched, and your 12 words still work.

If GitHub was the only account you linked and your 12 words are on this phone but not written down, write them down now (Settings, then View Recovery Phrase), or link Google, Facebook or (on an iPhone) Apple, as above. Until you do one of these, this phone is your only way into your account.
If your 12 words are written down, you have nothing to do. To have a sign-in account as well, link Google, Facebook or (on an iPhone) Apple, as above.
If GitHub was the only account you linked, this phone has no 12 words and you have none written down, link Google, Facebook or (on an iPhone) Apple now. Until you do, this phone is your only way into your account.

Who can open the copy

A linked sign-in account works because a locked copy of your account is kept for it. Where it is kept depends on how you linked it.

BeanPool's key vault: a sign-in linked in the phone app. When you link Google, Apple or Facebook in the phone app, or join with one, your phone locks a copy of your key, with your 12 words if the phone has them, to that sign-in and sends it to BeanPool's key vault: a small server in Iceland that does nothing else. The app says so where you link it, at Safety Backup and in Account Protection, under A sign-in you link. The vault gives the copy back only after Google, Apple or Facebook tells it that it's you. It waits a day first, and tells your other phones, so you can stop it if it wasn't you.

BeanPool can open these copies. For now one person, BeanPool's founder, looks after the vault. It is moving to three people in different countries, and then it takes two of them working together. The company that hosts it can read its memory while it runs, as with any rented server. A court could order a copy opened. Anyone who takes over your Google, Apple or Facebook account could get in too: see "If someone else tries". Tap Who can open it under A sign-in you link to read this in the app.

Your community's server: a copy it keeps itself, or one from before the key vault. Where your community keeps copies on its own server (see "Where your community keeps copies"), a sign-in you link there keeps its copy on that server. A copy your community kept before the key vault stays there until you move it or remove it (see "Moving a copy your community keeps"). The first owner of a community, who links a sign-in while setting it up, has that copy kept on the community's own server too, never at the key vault. The people who run that server can open it, because their server checks your sign-in. A stolen copy of the server's database can't, once the server has been updated for it.

The global community's server: a sign-in you joined with in a web browser. The web app has no link to the key vault. When you join the global community in a browser with a sign-in, the global community's server keeps the copy, and Safety Backup and Settings there say so. The people who run that server, BeanPool, can open it. On any other community, the web app makes no copy, and Settings there says whether that community's server keeps one.

If you would rather nobody but you could get in, use only your 12 words: keep them written down, and tap Remove everything in Where your account can be brought back from (see above), or Disconnect next to each sign-in account in the phone app. That deletes the key vault's copy at once, and from its backups within 30 days, or later if the vault is paused in that time. A copy on a community's server goes with Remove there, or Remove it instead (above). A standby server, the second server some communities keep ready to take over, deletes its copy too, the next time it copies from the main one (about once a minute). Removing a copy there does not delete the copies already in that server's backups. Each time a sign-in brings your account back from a community's server, the server keeps a record of it, and the copy it handed over for 30 days; then it deletes that copy and keeps only the record. The people who run the server can open those copies while they are kept. Your 12 words always work, with or without any copy.

If someone else tries

If someone starts getting back into your account with your linked sign-in account, your phones are told, and Settings shows Someone is getting back into your account, with when it goes through.

If it was you, on another phone, tap Yes, it's me and pass your phone's lock screen check. It goes through now, and Settings shows Let through until your other phone has your account.
If it wasn't, tap Stop. It never goes through, and whoever tried gets nothing. Then make sure that sign-in account has its own strong password.

A copy your community still keeps, from before the key vault, has no day's wait. If someone uses it, Settings shows Someone is recovering your account while it is under way. If it is not you, tap Stop It Now: your community's server then hands nothing more to that restore. If they get in, you get an alert that your account was just restored on another device, and they may already be in by the time you see it.

If the phone already has an account

Restoring a different account replaces the one on this phone, whether you restore with your 12 words or with a sign-in account. The app asks first, on Replace this phone's account? (with a sign-in account, once your account is back and you tap Continue). Nothing changes until you type WIPE, tap Replace Account and pass your phone's lock screen check. Tap Keep, then the account's name, go back to leave everything as it was.

Make sure you have the 12 words for the account you are replacing. If this phone has them, that screen shows them when you tap Show (the account's name) 12 words and pass your phone's lock screen check. If this phone has no 12 words for that account (Settings says so), without a linked sign-in account you cannot get it back.

Lost your phone and your 12 words

Without your 12 words and without a linked sign-in account, an admin of your community can move your account to a new phone, with your Beans, your name and your history. Go and see them in person: they check it's you first.

The admin makes a re-key code on their screen. If your old phone still has the app, it gets a notice that an admin started moving your account.
On your new phone, open BeanPool, tap Already a Member? Restore Account, then An admin gave me a re-key code. Scan the QR on the admin's screen, or type the code (it starts RK-) and your community's name. In a browser, the QR's link opens the same screen; or open your community's web app, tap I'm Already a Member →, then An admin gave me a re-key code, and type the code.
Your phone shows a two-digit number, and under it the address of the community it asked. Show both to the admin: they type the number on their screen. The number makes sure it's your phone they bind, and not someone who saw the code. Not now leaves the number: your phone keeps its place, and the same code shows the same number again.
If the new phone had no BeanPool account, it then shows the 12 words of your new key. Write them down: your old words no longer work, and your old phone stops working for good. A phone that already had an account (for another community) keeps that account's 12 words, and they now bring this account back too.
If you had linked a sign-in account, your phone asks you to link it again in Account Protection: the one you had protected your old key, so it was removed.
People you chat with will see that your key changed. Tell them it was you, and read them your My key code, in Settings under Account Protection on the phone. See "If a chat says the key behind a name changed".

The code lasts 24 hours. If your admin says your phone isn't the one they saw, or the code runs out, ask them for a new one.

The same guide is in the BeanPool app, and works there without a connection: open Settings, then "Help & how it works" under BeanPool. Every other rule, guide and manual is in the Help Centre. Guide version 162.