Accounts and sign-in

A Wrengle account is optional. You can download the desktop app, read every page of this documentation, create or open a vault, and use every local-only feature without ever signing in.

Where an account appears

• wrengle.com is the website and account portal. Sign-up and sign-in are available in Beta through email or Google. The dashboard provides profile and security settings plus account deletion. The documentation you're reading remains available without an account.
• The desktop app never forces you to sign in. It has an optional account entry in its status bar; that entry never prompts you during first run and never blocks local vault work.

Wrengle uses Clerk to handle account identity and sign-in sessions. Email and Google are the only supported sign-in methods. Choosing Google follows the same path as email sign-up: if you don't already have a Wrengle account, it can create one. Your individual account can also join team workspaces where the deployment enables them. Workspace admins manage membership and selected-vault access from the website; personal vaults remain separate. Where shared vaults are enabled, you can also accept invitations to another person's synced vault. See Sync and shared vaults for setup, permissions, and local copies.

By creating an account or using the service, you agree to Wrengle's current Terms of Use. The account service does not store a separate Terms-acceptance timestamp. The Privacy Notice explains how account data is processed.

The sign-in, sign-up, readiness, desktop OAuth, and first-time provisioning paths recheck the live production configuration. New account entry fails closed if the production Clerk tenant, Google connection, verified-email requirement, public registration, or self-service deletion configuration is unavailable or has drifted. Downloads, local desktop work, and these docs stay available if the account service is unavailable.

Browser sign-in

Choose Sign in on the website, then continue with email or Google. Starting sign-in from a documentation page returns you to the exact page you were reading. Every sign-in session belongs to wrengle.com — the documentation you're reading does not have a separate session of its own.

Choosing Google to sign in does not give Wrengle access to Gmail, Google Calendar, or any other Google product data. It only sends an authentication request to Google and shares your basic identity — account identifier, email, name, and profile image — with Clerk. Those integrations use their own separate connections, scopes, disclosures, and controls.

Wrengle requires a verified email and never merges accounts by name or profile image alone. Google sign-in needs a normal browser window and does not work inside an embedded or in-app browser. Desktop sign-in reflects this — it opens your operating system's own browser rather than an embedded window. For account-alias security, Wrengle rejects Google sign-in for email addresses containing +, =, or #.

The direct Developer ID release uses that system-browser flow. A future Mac App Store submission remains blocked until Wrengle adopts and verifies an App-Store-appropriate native or system authentication session; this does not block direct Developer ID distribution.

If the readiness check fails, Clerk is unavailable, or account support is not configured, the documentation still renders. The sign-in and sign-up routes fail closed and show a page error instead of presenting an account form, while downloads and local desktop work continue normally. Browser code receives only Clerk's publishable key, never its secret key.

The account menu offers Dashboard, Manage account, and Sign out. Signing out clears your session across the whole website, including this documentation.

Desktop sign-in

Desktop sign-in opens your system's own browser rather than an embedded window, and it never asks for your password inside the app itself. Your Clerk refresh token and cached account summary stay in the operating-system keychain. The JWT access token stays only in protected native-process memory and is reacquired with the refresh token after an app restart. Neither token is exposed to the app's interface, written to the vault, or written to logs. The desktop is a public OAuth client: it uses S256 PKCE and has no OAuth Client Secret. The authorization returns only the profile, email, and offline_access scopes, and Clerk sends the browser back to a temporary listener bound to 127.0.0.1 on your own computer.

Before opening the browser, desktop sign-in requires an exact successful response from Wrengle's production readiness endpoint. A failed readiness check leaves the app signed out and every local vault feature usable.

If Wrengle's account service is offline, your local vault and every local-only feature keep working — only account-dependent actions wait until the service is reachable again. The app's interface itself only ever holds a sanitized account summary: your display name, primary email, avatar, and when it last verified your session.

Reading your saved refresh credential at startup does not itself verify your session or expose it to the app's interface. When you've signed in on desktop before, Wrengle reads it from the keychain into protected native memory; the first account-dependent operation refreshes the in-memory JWT and performs real verification. If nothing was saved, you simply start signed out, and the rest of startup proceeds normally. If a saved credential is denied or locked, the affected account features enter Limited mode without blocking your local vault work.

That saved credential also caches your last-verified name, email, and verification time so your identity can display while offline; it does not keep your avatar, and on some systems it may drop your name or email if the operating system's storage for it is too small. Normal debug sessions use a development-only account credential slot, separate from the released app's slot. This account-slot isolation is independent of Wrengle Dev's com.wrengle.desktop.dev Tauri identifier. A normal debug build cannot overwrite or delete the account credentials from a release build.

Your browser session and your desktop session are separate. Signing out on the website does not sign you out on desktop, and signing out on desktop does not touch your browser session — sign out on each place you no longer want connected. A browser session, or a sign-in from a different app, cannot be used to access or sign out of your desktop account; only a sign-in performed through the desktop app itself works there.

If removing your saved credential would need an extra system prompt, Wrengle fails closed instead of showing you one: it asks you to reconnect or recover the next time you open the app, rather than leave a prompt sitting over your workspace or report a change that did not actually happen. Signing out on desktop is local-first: Wrengle removes the saved account bundle, then sends the refresh token directly to Clerk's revocation endpoint. No OAuth Client Secret is involved. Ordinary use, background session refresh, and routine cleanup never prompt you.

Successful refresh-token revocation prevents that grant from minting another access token. It does not invalidate a JWT Clerk already issued. That access JWT can remain valid until its expiration, for up to one day, although the signed-out Wrengle app no longer retains its copy. A copy obtained before sign-out can retain that residual lifetime. If the direct revocation request cannot be confirmed, Wrengle still stays signed out locally and reports that the remote refresh grant may remain active rather than claiming it was revoked.

On the first run after upgrading from the earlier opaque-token preview, Wrengle moves the old refresh token into a pending-revocation keychain entry before removing the legacy account bundle. If Clerk is unavailable, cleanup is reported as pending and retried after restart; the only remaining copy is not discarded until Clerk confirms revocation.

What an account enables

Signing in alone does not upload, sync, or copy your vault. Sync is optional and off by default; you turn it on per vault from Settings → Account. When it is on, that vault's notes, charts, whiteboards, whiteboard images, note frontmatter, and folder structure are kept the same on your own computers, stored on Wrengle's sync service encrypted in transit and at rest; Wrengle can technically read that content to operate the service. Attachments outside whiteboards do not sync. Turning sync off keeps your local files and does not delete existing server copies. See Sync across your computers.

Beyond identity, a Wrengle AI credit balance, sync, and optional team workspaces, this release does not include team subscriptions, licenses, gated downloads, hosted workflow execution, or private documentation. Credits are spent only by AI requests you make; running out stops those requests and changes nothing else about what your account can access. Creating the account does not grant a free or recurring AI allowance; see Wrengle AI and credits. The Jira editor action requires a Wrengle account for its separate Atlassian OAuth handoff; Jira workflow actions are not available in v1.

Connections to other providers, such as the beta Gmail draft action, use their own separate sign-in and privacy boundaries. A Wrengle account does not stand in for those provider credentials. A connection name in a preview surface is not an availability promise; see Connections and actions for the release matrix.

Account data and deletion

Clerk stores the identity, sign-in methods, and session data your account needs to work. Wrengle keeps its own minimal copy of your account profile for the dashboard, and deletes that copy — along with the records that depend on it — as soon as you confirm account deletion. A pseudonymous marker can remain afterward, keyed to the deleted account by an internal identifier rather than by your name or email; its only purpose is to stop a delayed webhook from accidentally recreating the account you just deleted.

Account deletion never deletes or changes your vault files, local settings, or local backups. Delete your account from the dashboard at wrengle.com/dashboard. Deletion signs you out of the website everywhere, and a desktop session clears its saved local credential the next time it checks in after deletion.

Clerk sets the cookies it needs for sign-in and contacts its own services whenever the account interface is enabled — for authentication, not for tracking you. Wrengle does not attach your Clerk identity to its pseudonymous website or desktop usage data.

See AI and privacy for the separate boundaries around vault data, AI providers, connected services, and privacy-minimized desktop telemetry.