Account and access

Keeping your account secure

For anyone worried about their account — what to do right now if someone else has access, and the security controls worth knowing about.

If you think someone else can get into your account, reset your password. That is the one action in EVVA that ends every signed-in session on the account at once, on every device and in both apps.

Do this now

1

Reset your password

Go to EVVA’s sign-in page, press Forgot your password?, and follow the emailed link. Setting the new password signs out every session on the account, including whoever else was in it. Full steps: Resetting your password.

2

Check your connected accounts

Open /account and look at Connected accounts. Press Remove on anything you do not recognise. If it refuses with This cannot be removed while it is the only way to sign in, set a password first, then remove it.

3

Check the device count, if you are a creator

The creator app’s settings shows Active sessions. After a password reset it should show only the device you are on.

4

Tell us

Email support@evvahub.com. Most sign-in failures look identical from the outside on purpose, so what you saw on screen usually cannot tell us which account was involved — but EVVA’s own records can.

Resetting the password is what removes access. Sign out everywhere in the creator app is not a substitute: it keeps the current device signed in, and if that current device is someone else’s, they stay in. See Signing out, and checking which devices are signed in.

Other security controls

These are worth knowing about before you need them.

The creator app’s settings screen has a switch labelled Two-factor login, with the note A code from your phone on every new device. Turn it on and signing in on a device you have not used before asks for a code as well as your password.

Whichever way you sign in, a strong, unique password is your first line of defence. Use one you do not use anywhere else.

The creator app’s settings has a Delete account row with a Delete button and the note Fans lose access immediately. Nothing comes back. Read that note literally — deletion is not something you can undo.

The Download my data row beside it gives you a copy of what EVVA holds on your account. Take that first if there is anything you want to keep.

You can also ask us to delete the account by emailing support@evvahub.com. Your right to ask for deletion, and how it is handled, are set out in the privacy policy.

The reset flow is how you change a password, and it signs every device out as a side effect. See Resetting your password.

On EVVA, Log out ends the session you are in, and a password reset is what clears every other device at once. Creators also get a device count and a Sign out everywhere button in the creator app’s settings — see Signing out, and checking which devices are signed in.

EVVA refuses sign-in after 10 failed attempts for one address from one connection inside 10 minutes. It is a speed bump on one connection at a time, not a lock on your account, and it clears by itself — nobody needs to unlock anything, and a successful sign-in resets the count.

Do not treat it as protection against someone who has your password. A strong, unique password and a prompt reset are what protect the account.

Why error messages tell you so little

Most sign-in refusals in EVVA are worded identically whatever went wrong. A wrong password and an address with no account give the same message. An expired reset link, a used one, and one that never existed give the same message. A sign-in attempt that timed out and one started in a different browser give the same message.

That is on purpose: a message that distinguished them would let a stranger work out which addresses have EVVA accounts.

The practical consequence for you: a screenshot of the error rarely explains what happened. If you are stuck, contact support@evvahub.com with the address on the account and roughly when you tried — support can read what EVVA recorded, which is the only record that can tell the cases apart.