Account Security and Data

Open Settings → Profile → Security (/settings/profile#security) to manage the controls described here.

Password policy and lockout

Passwords must be 10–128 characters, must not contain your email (or its recognisable local part), and must not be a common or known-breached password. Use a unique password manager-generated value.

Ten failed sign-in attempts within a 15-minute window temporarily pause sign-in for 60 seconds. The counter continues across these short locks, so repeated attempts remain throttled. A successful login or password reset clears the failure state.

Sessions

The session registry shows active browser/device labels, approximate country, masked IP prefix, and last activity. You can terminate any session except the one currently in use, or choose End other sessions. Change or reset your password if you do not recognise a device.

Two-factor authentication and recovery codes

1. Select Set up 2FA and scan the QR code with an authenticator app (or enter the secret manually).
2. Enter the current six-digit code to enable it.
3. Save the ten one-time recovery codes shown after verification.

Each recovery code works once. Store them away from your password; never send them to support. You can regenerate a full set after confirming a current authenticator code—this invalidates the previous set. Disabling 2FA also invalidates all recovery codes.

Export your data

Choose Export data. One export can be requested per 24 hours. AdWitch prepares a JSON file and emails its private download link; the file expires after 72 hours. It contains account and consent details plus applicable teams, ad metadata, conversations, billing transactions, sessions, and notifications—not media binaries or payment-card details.

Delete your account

Choose Delete account, enter your password when required, then follow the email confirmation link within 24 hours. You can request deletion up to three times a day. Deletion is scheduled after confirmation, with a 14-day grace period in which it can be cancelled. Export anything you need first. After grace, identifiers, credentials, sessions and Meta tokens are erased or anonymised; limited billing and audit evidence is retained as described in the Privacy Policy. Published CDN media may remain until follow-up cleanup.

Removing AdWitch from Facebook only revokes Meta access; it does not delete the AdWitch account.

Legal consent

Registration records the legal-document version you accepted and your confirmation that you are at least 18. The current consent version and acceptance date are visible to the service for accountability. Future material legal updates may ask you to review a new version. See the Privacy Policy, Terms of Service, and Data Deletion page.