Account & security

This guide covers managing and deleting your Rivalizer account, plus a high-level look at the extra security that protects the platform operator. Most of the security model is invisible to everyday users by design.

Managing your account

Everything about your account lives on the Profile page:

• Edit profile — display name and avatar.
• Your store — your issuer storefront (public or invite-only).
• Wallet — link or view your connected wallet.
• Stats & activity — your reputation, win %, contracts, and activity feed.
• Delete account — the "danger zone" at the bottom.

To sign out, use Log out. Because sign-in is passwordless, getting back in is just another magic link (or wallet signature) away.

Deleting your account

You can permanently deactivate your account yourself.

How to delete

1. Go to Profile and scroll to the Delete account section (the red "danger zone").
2. Click Delete my account.
3. A confirmation appears — click Yes, delete my account.
4. You're signed out and returned to the home page.

What deletion does

Deleting your account soft-deletes it. This means:

• Your account is deactivated and login is blocked going forward.
• Your personal info is anonymized — your email, wallet link, and avatar are removed, and your display name becomes "Deleted user."
• Your financial history stays intact so that contracts and wagers you had with other people aren't broken. Counterparties are unaffected.

This cannot be undone.

When deletion is refused

To make sure nothing of value is stranded, Rivalizer refuses to delete your account while either of these is true:

Condition	What you'll be told
You still hold a cash balance	"Withdraw your balance before deleting your account."
You have open bets or wagers (unsettled positions, or matched/open trophy wagers)	"Wait for them to settle (or cancel unmatched ones) before deleting your account."

So before deleting: withdraw any balance and settle or cancel your open bets and wagers, then try again.

Account security at a glance

A few things keep everyday accounts safe:

• Passwordless sign-in — no password to leak or reuse. Access requires either a one-time email link or a wallet signature.
• Single-use, time-limited links — magic links are one-time and expire in 30 minutes; sign-in requests are rate-limited.
• Wallet proof, not custody — linking a wallet only proves ownership via a signed message. Rivalizer never moves your funds or asks for a seed phrase, and a wallet can't be hijacked onto a second account.

The owner step-up model (operator only)

This section is for context only. It applies to the platform operator (the "owner"), not to regular users — you'll never encounter it in normal use.

Rivalizer has a single master owner account: the only account that can touch money and core platform settings (treasury, fees, on-chain/company-wallet settings, and transferring ownership itself). Ownership is pinned in the database, never in configuration files, so a server breach alone can't grant it.

To perform any of those high-risk actions — and to log into the admin console once set up — the owner must pass a two-step "step-up" confirmation:

1. Password — re-enter the owner password.
2. Emailed one-time code — a 6-digit code is sent to the owner's fixed confirmation email, which must be entered to complete the action.

Additional safeguards include: the confirmation email is immutable once set (it can't be redirected from the UI), changing the owner's credentials itself requires a full step-up, codes expire after 10 minutes, and challenges are burned after too many wrong attempts. The net effect is that simply hijacking a live owner session is not enough to move money or seize control.