Account security and deletion

Sign-in and password security

• Use email and password or Google sign-in.
• Google and password access with the same email resolve to one Bandpit user.
• Password reset links are random, hashed, single-use, and valid for one hour.
• Google-only accounts do not have a local password to change.

Delete the account safely

Account deletion removes the user and cleans up data owned only by that person. A sole-member band and its private data are removed with the account.

• Transfer or add another admin before deleting an account that is the only admin of a multi-member band.
• Cancel an active subscription before deleting the sole owner account of that band.
• Deleting a venue's last owner removes the claimed venue profile, while gig locations keep their written fallback details.