Settings & your account

Settings is where you shape how RowFold sees you and how it looks to you: your name and photo, how dates and money are formatted, interface preferences, notifications, data export, and account-level actions like transferring a workspace or deleting your account. Open your settings Click your name at the bottom of the left rail and choose Settings. Everything on this page belongs to your account, not to any one workspace: changes here follow you across every workspace you're a member of. The page's side navigation jumps between cards: Profile, Formatting & locale, Preferences, Notifications, Security, Data export, and Danger zone. Update your name and photo Type a new name into Display name and click Save profile. Your name and initials update in the rail and everywhere teammates see you, immediately — no need to sign back in. The Email field is shown for reference and can't be edited here. Click Upload image (or Change image if you already have a photo) to set a profile photo. It must be a PNG, JPG, WEBP, or GIF, 2 MB or smaller, and it appears right away. Until you upload one, RowFold shows your initials on a colored chip instead. Choose how dates, numbers, and money look The Formatting & locale card controls how dates, numbers, currencies, and times appear for you, everywhere in RowFold. Pick a Language & format, a Currency, and a Time zone, then click Save formatting. Each menu starts on Auto — match this device. On Auto, no preference is stored: each device you use formats things using its own language and time-zone settings, and a hint under each menu shows what this device resolves to (for example en-US or Europe/London). Choose an explicit option and it follows you instead — every browser you sign in on formats the same way. The Preview row shows a sample amount, date, and time that updates as you change the menus, so you can see exactly what you'll get before saving. One thing the locale doesn't change: times are shown on a 12-hour clock with AM/PM, everywhere a person reads one — the calendar, the scheduler, booking pages, confirmation emails and automation messages. Your Language & format choice still sets the date pattern (11/06/2026 or 06.11.2026), because wanting a European date and wanting a 24-hour clock are separate preferences and only the first is asked about. Stored values, CSV exports, the API and anything you type into a time box are unaffected — this is how a time is displayed, not how it is kept. The time zone your workspace works in An admin sets the workspace's time zone in Settings. It defaults to the zone of whoever created the workspace rather than to UTC, so it is usually right before anyone touches it. This is the clock for things that belong to a place. Record dates are stored as plain wall-clock time, and this says which wall. It is also what two other things now run on: • Scheduled automations. "Every day at 9am" means 9am where you work. • Relative date filters. "Due in the next 7 days" counts against your calendar. Both of those used to run on UTC for everybody. This is separate from the time zone on your own profile, which governs instants — "edited 2 hours ago", when a digest was sent — and those still render in yours. Leaving your personal one on Auto follows your device. What the AI should know Beside the time zone and the currency, an admin can write a note for the AI: what your words mean, what you call things, and which tables to leave out unless asked. Ask and Build with AI read it from the next message on, for every member. It shapes how questions are understood and never what anyone may see — see Ask RowFold & AI tools. Tune preferences and notifications Under Preferences, four switches shape the interface across the product: Show schema graph on every workspace home, Highlight relation fields in violet, Use plain-English labels (Summary not Rollup, Hops not Walks), and Enable beta features. Click Save preferences to apply. Under Notifications, choose Email and In-app delivery separately for Mentions on records, Workspace digest (weekly), and Date reminders, then click Save notifications. Rewrite the emails RowFold sends for you Settings → Email templates lets an admin rewrite the mail sent on the workspace's behalf, with a live preview against sample data, tokens for the record and the workspace, and a reset back to the original wording. • To your customers: form acknowledgements, ticket replies, chat transcripts. • To your team: new form submissions, the daily digest, watched records changing, mentions, and the four approval emails (requested, decided, reminder, escalated). Two limits are deliberate. A customer-facing template can only reference what that surface already publishes, and a member-facing one is resolved against each recipient's own permissions — so a template can never become a way to email somebody a field they aren't allowed to see. And RowFold's own mail is not editable: invitations, sign-in links, security and new-device alerts, verification. That isn't an omission. An admin who could rewrite a sign-in email could phish their own team with a genuine, correctly-signed RowFold message. Sign in, stay signed in, sign out You normally sign in with your Work email and Password, or with Google or Microsoft if your RowFold shows those buttons. Email me a sign-in link remains available as a secure one-time alternative whenever you do not have your password handy. Keep me signed in is ticked by default and keeps you signed in on that browser for 30 days, renewing as long as you keep using RowFold; untick it and your session ends when you close the browser. To sign out, click your name at the bottom of the rail and choose Sign out. You land back on the sign-in page. Everything else about signing in lives on Settings → Security: two-factor authentication, which identity providers your account answers to, every browser currently signed in, and — if you own a workspace — what you require of your team. Sign-in links work once and expire after 30 minutes. Opening one signs that browser in and spends the link. That is what keeps a forwarded email from becoming a way in. A spent or stale link says so plainly and offers a fresh one to the same address. See and end your active sessions Settings → Security lists every browser currently signed in to your account: the browser and operating system, how it signed in, the address it signed in from, and when it was last active. The one you are reading from is marked This device. Press Sign out on any other row to end that session on its own. Sign out other sessions ends all of them but keeps you signed in here — that is the one to reach for when you spot a row you do not recognise. Sign out everywhere ends every session including this one, and also forgets your recognised devices so the next sign-in anywhere emails you; use it if you think someone else has access. Ending a session takes effect immediately on the server you are talking to and within a minute everywhere else. You get an email whenever sessions are ended, as you do for any change to your password or two-factor setup. Connect Google or Microsoft to your account The Connected accounts card on Settings → Security shows which identity providers your account answers to, and offers a Connect button for the ones it does not. Connecting from here, while already signed in, is the only way to link a provider that will not vouch for your email address — RowFold matches you on the provider's own account id rather than on the address, so a provider it does not already know cannot claim an existing account by asserting its email. Disconnect removes a link. RowFold refuses if it would leave you with no way to sign in — an account with no password and no other provider, or one whose team requires single sign-on. Connecting a provider does not change how your current session was authenticated. If your team requires single sign-on, sign in with the provider to get a session that satisfies it. Require single sign-on for your team If you own a workspace, Settings → Security offers Require single sign-on. Switch it on and everyone in the workspaces you own must sign in with Google or Microsoft: password sign-in is refused for them, and anyone already signed in with a password is asked to switch within a minute. It sits beside Require two-factor for your team and the two work together. The switch stays unavailable until it is safe to use: an identity provider must be configured, you must have connected one to your own account, and everyone on your team must have connected one too — the card names anyone who has not. This is stricter than the two-factor requirement on purpose. Somebody told to set up two-factor can always do it on the page they land on; somebody told to use single sign-on cannot, if their provider will not vouch for their address, so the switch waits for them rather than locking them out. You are exempt from your own switch, so a provider outage can never strand the one person who can turn it off. Export your data, transfer a workspace, or delete your account Under Data export, Full workspace JSON downloads the schema and every record across all your workspaces, and CSV per table downloads a zip with one CSV for every table you can access. Both work at any tier. A third tile, PostgreSQL dump, is shown as a Business-tier feature and isn't active here. The Danger zone holds the irreversible actions. Transfer hands a workspace you administer to another member: they become the Admin and you stay on as an Editor. Delete account removes your profile, memberships, and permission overrides after you type your email to confirm — shared workspaces stay intact for their other members, and it cannot be undone. Understand the "viewing as" banner A dark banner across the top of every page reading You're viewing as … means this browser session is a super-admin signed in as another account, usually to help with a support question. Clicking Return to your account switches the session straight back to the admin's own account. Impersonation is deliberately visible and safe: every start and stop is written to the audit log, the impersonated session never outlives the browser session, and deleting the account is blocked until the admin returns to their own account. The Admin console (super-admins only) Super-admins see an extra Admin entry in the Manage workspace panel, marked with a SUPER badge. It opens the Admin console: every account on this RowFold instance — name, email, workspace count, and join date — with a search box that matches name or email, and a super-admin badge on allowlisted accounts. Clicking Log in as → starts impersonating that account after a confirmation prompt. You can't impersonate yourself or another super-admin. Super-admin status itself comes from a server-side allowlist set at deployment — no account can grant it from inside the app. Tips • The formatting Preview updates live — try a few options before you click Save formatting. • While a formatting menu is on Auto — match this device, a hint under it shows exactly what your current device resolves to. • A new photo or display name shows up in the rail instantly — no sign-out needed. • Your data is one click away at any tier: Full workspace JSON or CSV per table under Data export. • Not sure whether a session is yours? The row shows the browser, operating system and sign-in address — and yours is labelled This device. • Sign out other sessions is usually the one you want; Sign out everywhere logs you out here too. • The workspace time zone is what scheduled automations and "next 7 days" filters run on. Your personal time zone only affects how instants like "2 hours ago" are shown to you. Good to know • On Auto formatting, your laptop and your phone can show different date and currency formats — each follows its own device settings. Pick explicit values if you want consistency across devices. • Profile photos must be PNG, JPG, WEBP, or GIF and 2 MB or smaller; anything else is rejected with a message. • Your email address can't be changed from Settings — the field is read-only. • Transferring a workspace takes effect immediately: you become an Editor there and lose admin control. • Delete account requires typing your email to confirm (capitalization doesn't matter) and cannot be undone, though shared workspaces remain for their other members. • Requiring single sign-on stays greyed out until every member of your workspaces has connected a provider — that is deliberate, because someone who has never linked one cannot always link one afterwards. • Connecting a provider does not convert the session you are in: if your team requires single sign-on you still have to sign in with the provider once. • You cannot end the session you are reading from — that row has no Sign out button, because signing out is what that is. • Ending a session is immediate on the server you are talking to, but can take up to a minute to reach the others. Who can do what • Settings is available to every signed-in user and only ever edits your own account. • The Admin console is visible and accessible only to super-admins; super-admin status is an email allowlist in server configuration, not something any account can grant in-app. • Super-admins can impersonate any account except themselves or another super-admin, and every start and stop of impersonation is written to the audit log. • Transfer workspace ownership only offers workspaces where you are the Admin and at least one other member exists; completing it promotes them to Admin and moves you to Editor. • Deleting an account is blocked while impersonating — the admin must return to their own account first.