Manage personal details

Where to find the Personal details

In the top menu bar, click " (Settings)".

The Personal details page opens.

Profile information

Your profile picture

Your profile picture sits in the top left. If you have not uploaded one, Trustlytics checks with Gravatar first. That is a free service where you link a picture to your email address. If there is a picture there for your sign-in address, it appears here automatically without you doing a thing. And if not, Trustlytics shows your initials in a colored circle. That is not a placeholder you have to get rid of, it can simply stay that way.

Upload a picture: click "Choose image" and pick a picture from your device. As soon as you have selected it, Trustlytics uploads it automatically. There is nothing extra to confirm. Your own picture always takes priority, so it overrides a Gravatar.

Allowed images: JPG, PNG, GIF, or WEBP, 2 MB at most. Trustlytics shrinks larger images itself, so there is no cropping for you to do.

Remove the picture: as soon as a picture is uploaded, a red "Remove image" button appears as well. One click removes the picture after a short safety prompt. After that, your Gravatar takes over again, or your initials sit in the circle.

Name and email

Below that you find a form with three fields:

Change whatever you want to change and click "Save".

With the name, it is done in a second. With the email, Trustlytics is deliberately stricter, and for good reason.

Important about changing your email: a new email is not applied right away. Instead Trustlytics sends a confirmation email to the new address. Only once you click the link in it does the new email become active. That makes sure the address really belongs to you and that nobody exploits a typo at your expense.

And so you are not left in the dark in the meantime:

• As long as the confirmation is missing, you see a notice bar at the top of the page: "Email change pending", with the new address and the expiration date.
• The confirmation link is valid for 24 hours. After that, you have to start the change again.
• Until it is confirmed, you keep signing in with your old email. So you never lock yourself out by accident.
• If the new address is already in use with another account, Trustlytics reports an error and the change does not happen. Two accounts with the same email is not possible.

Security

This box is the heart of the page. Four sections, and each one makes your account a little safer.

Changing the password

To change it, you fill in three fields:

An eye icon sits next to every field. One click and you see what you typed in plain text. Handy when you want to be sure there is no typo in there. For the new password, a strength meter also shows you how good your choice is. At the end you click "Save password".

The rules, short and sweet:

• At least 10 characters.
• Both new fields have to match.
• The new password must not be the same as the old one.

Two-factor authentication (2FA)

This is where it gets serious, in the best sense. Two-factor authentication is the most important extra protection for your account. And it is not a recommendation, it is required..

You have a choice: 2FA or a passkey. You do not need both, one of the two is enough. And it pays to decide early here:

So anyone who would rather work with a fingerprint or face recognition than a 6 digit code should set up the passkey right at the start. How that works is in the next section.

What is behind 2FA? When you sign in, your password alone is no longer enough. On top of that, you type in a 6 digit code generated by a small app on your phone or a browser extension, for example, Proton Pass or Bitwarden. Recommended: Proton Authenticator. Google and Microsoft Authenticator work too but offer less privacy. This code changes every 30 seconds. The trick to it: even if somebody knows or guesses your password, they get nowhere without your phone or browser extension.

Here is how you set up 2FA:

1. Click "Activte 2FA".
2. A QR code appears under "2. Scan the QR code". Open your authenticator app and scan that code. The app creates Trustlytics as a new entry with it. No scanner at hand? Under "Manual entry" you see a key as text that you can type into your app. The result is exactly the same.
3. The app now shows a 6 digit code. Type that into Trustlytics under "3. Enter the code from the app".
4. Now comes the most important step. Trustlytics shows you eight recovery codes, your emergency codes in case your device goes missing. Save these codes somewhere safe before you click on. They appear only this one time.
5. Confirm with the "I have saved the codes securely" button. Only then is 2FA fully set up.

From your next sign-in on, Trustlytics asks for the 6 digit code from your app.

When 2FA is not active yet, you see a gray "Disabled" label and the "Activate 2FA" button.

When 2FA is active, you see a green "Enabled" along with the date, a red "Disable 2FA" button, and a "Generate new codes" button

Generating new recovery codes

Codes used up, misplaced, or not sure whether the list is still somewhere protected? Then click "Generate new codes". Trustlytics creates eight new codes and shows them to you.

Disabling 2FA

The red "Disable 2FA" button lifts two-factor authentication. Trustlytics asks first to be safe so that it does not happen with an accidental click.

Once you confirm, the link with your authenticator app is deleted, and your recovery codes expire as well. The entry in your app keeps showing codes afterward, but Trustlytics no longer accepts them. So you can delete that entry in the app.

And if you switch 2FA back on later? Then the process starts from scratch: new QR code, new link in the app, and eight new recovery codes.

Passkeys

A passkey is the more modern and in many ways more convenient way to sign in. Instead of typing a password, you unlock with your fingerprint, face recognition, or device PIN. Exactly the way you unlock your phone.

Why that is not just more convenient but also safer? A passkey cannot be typed out, cannot be guessed, and cannot be scooped up in a data breach. It never leaves your device. There is simply nothing for an attacker to steal. Phishing emails trying to fish out your password run into a wall with a passkey.

If you do not have a passkey yet, a notice to that effect is shown.

Here is how you create a new passkey:

1. Type a name into the text field that you will recognize the passkey by later. Something like "My iPhone" or "Work laptop". The name is purely for you so you keep track in the list.
2. Click "Add passkey".
3. Your device asks for your fingerprint, face, or PIN. Confirm.
4. Done. The passkey appears in the list.

If you already have a passkey, you see a list of your passkeys, each one with:

• Name: the label you gave it when you created it.
• Created on: when you created the passkey.
• Last used: when you last signed in with it, or "Never used".
• A red "Remove" button per row, after a safety prompt.

A tip from practice: go ahead and create several passkeys, one per device you use regularly. Then you get in comfortably from the laptop as well as the phone, and losing a single device never locks you out.

If your device does not support passkeys, a notice appears, and adding one is not possible. A passkey is also tied to the address you created it on.

Removing a passkey

Sold the device, replaced the laptop, or has the list gotten messy over the years? Then click the red "Remove" button in the row in question. Trustlytics asks first to be safe so that it does not happen with an accidental click.

Once you confirm, the passkey disappears from the list and no longer works for signing in. Your other passkeys are untouched by it.

Two things to keep in mind while doing it:

First, your second safeguard. Remove your only passkey without having 2FA set up, and your account is missing its required safeguard. Trustlytics then asks you to enable 2FA again at your next sign-in. In that case, set up 2FA first and remove the passkey only afterward.

Second, your device. The passkey is only removed at Trustlytics. On your device or in your password manager, the entry stays put and may keep showing up as a suggestion when you sign in. It will not work anymore. Delete it there separately so that no confusion comes up.

Recent sign-ins

At the very bottom sits a table with your last ten sign-in attempts. Small, but valuable. This is where you spot whether a stranger is rattling at your account.

The one look that pays off: if you see failed attempts here that did not come from you, maybe in the middle of the night or from a foreign country, change your password immediately and switch on two-factor authentication if you have not already. This table is display only, there is nothing to click here.

What is in it for me?

This page has two jobs, and both pay off:

• You keep your details current. Correct name and correct email. Sounds like small stuff, but it makes sure notifications land where they should.
• You make your access genuinely secure. Your Trustlytics account holds all your visitor data. Weak access would be the open back door to everything. With a strong password, active two-factor authentication, and a passkey, you bolt that door three times over.

Bottom line: five minutes here, set up properly once, and you will not have to worry about your access for a long time. Those five minutes are time well spent.

If you remember only one thing from this article: switch on two-factor authentication and create a passkey. That is the biggest security gain for the smallest effort.

Common questions

Where does my profile picture come from, even though I never uploaded one?
Then there is a picture for your email address at Gravatar. That service links a photo to an email address, and many websites pull it in automatically. Trustlytics does the same, as long as you have not stored a photo of your own. If you want a different picture, simply upload one.

I do not want to see my Gravatar picture here. What do I do?
Upload a photo of your own, then the Gravatar is overridden. Or change the picture at Gravatar directly. The latter takes effect everywhere you use that email address, though.

I changed my email, but sign-in only accepts the old one. Why?
Because the change only counts once you have confirmed it. Trustlytics sent an email to the new address. Click the link in it, and the new email takes effect. Until then, you sign in with the old one. The link is valid for 24 hours, after that, you start the change again.

I did not get the confirmation email for the new address. What do I do?
Check your spam folder first. If nothing arrives, you may have mistyped the new address. Just start the change again with the correct address.

Why was I signed out on my other devices after changing my password?
That is intentional and serves your security. If somebody was signed in on a device that is not yours, the new password throws them out automatically. Your current window stays open, on the other devices, you simply sign in again.

I got an email saying my password was changed, but I did not do anything. Now what?
Act immediately. Try to sign in and set a new password. If you cannot get in anymore, somebody else is signing in with your details. Contact support right away.

Do I really have to switch on two-factor authentication?
Yes. In Trustlytics a second safeguard is required, either 2FA or a passkey. That protects not only your account but all the data hanging on it.

What happens if I disable 2FA?
The link with your authenticator app is deleted and your recovery codes expire. Trustlytics asks first to be safe. A second safeguard stays required. Without a passkey, Trustlytics asks you to enable 2FA at your next sign-in.

What if I lose the phone with my authenticator app?
That is what the recovery codes from setting up 2FA are for. With one of them, you sign in anyway. Which is exactly why those codes should not sit on the same phone. If the codes are gone too, get in touch with support.

I clicked the recovery codes away without saving them. What do I do?
No drama, as long as you are still signed in. Go to "Personal details" and click "Generate new recovery codes" at two-factor authentication. You get eight new codes, the old ones expire. Do that right now.

I generated new recovery codes. Are the old ones still valid?
No. As soon as new codes are created, all the old ones expire, including the unused ones. So you can throw an older list away, it does not work anymore.

Can I have several passkeys?
Yes, and it is even recommended. Create one per device you use regularly. That way you get in comfortably everywhere, and losing one device never locks you out.

Why does my passkey not work on another computer?
A passkey is tied to the address you created it on and to the device or password manager it sits in. Some providers, Proton, Apple, or Google, for example, sync passkeys across several devices through your account. If that is not the case for you, simply create an additional passkey on the second device.

What happens when I remove a passkey?
It disappears from the list and no longer works for signing in. Trustlytics asks first to be safe. Your other passkeys are untouched. Careful if it was your only one and you have no 2FA: your account is then missing its second safeguard, and Trustlytics asks for a new one at your next sign-in.

I removed the passkey, but my browser keeps suggesting it. Why?
Because it was only removed at Trustlytics. The entry is still on your device or in your password manager. You cannot sign in with it anymore. Delete it there in the settings, and the suggestion disappears too.

Passkey or password with 2FA, which is better?
Both are secure. A passkey is more convenient because you do not type anything and do not wait for a code. The most relaxed setup is to create a passkey and leave 2FA active as a fallback.

I see a failed attempt in the recent sign-ins that was not me. Has my account been hacked?
A failed attempt means, first of all, that somebody did not get in. Still: change your password immediately to be safe and switch on two-factor authentication if you have not already.