Accounts, web sign-in, and desktop authorization

Weave uses an Apple account to identify you. An account enables membership, device management, and cloud features you explicitly choose. Signing in does not upload an entire local knowledge base.

Why the desktop app opens a browser

The desktop app intentionally uses the system browser as a security boundary. The website does not need to pass Apple credentials through an embedded desktop WebView, and you can verify the domain and active account in a familiar browser.

The flow works as follows:

1. The desktop app creates a short-lived session with random state and a PKCE challenge.
2. The system browser opens the Weave authorization page.
3. If a web session already exists, you only confirm the current device. Otherwise, sign in with Apple first.
4. The browser issues a one-time authorization result and returns to Weave.
5. The desktop app exchanges that result with its PKCE verifier for desktop credentials.

The authorization result cannot be redeemed twice. A state mismatch, expired session, or callback outside Weave causes the authorization to fail.

How web sign-in is stored

Web access and refresh credentials use Secure, HttpOnly, SameSite cookies that page scripts cannot read. Requests that modify profiles, devices, or account state also require a matching CSRF token and an allowed Weave origin.

When a session expires, the website rotates the refresh credential. Concurrent account requests share one refresh operation so that profile, membership, device, and storage loading cannot invalidate the session through duplicate rotation.

What the account center manages

• View and change your display name;
• inspect the active membership source and expiration;
• review signed-in devices and their last activity;
• remotely remove another device;
• review cloud-file usage and learning-asset summaries;
• save language, appearance, and notification preferences;
• request or cancel account deletion.

The current device cannot be remotely removed from the device list; use Sign out instead. Signing out on the web revokes the current browser refresh credential without signing out other devices.

Account deletion

A deletion request starts a seven-day cooling-off period. You can cancel it from the account center during that period. Final deletion follows server-side review and retention rules. Sign-out and deletion cancellation remain available while the request is pending.

Data boundaries

• The API manages account details, device records, membership, and cloud files you explicitly upload.
• Local knowledge-base source files, full-text indexes, and local semantic indexes remain under desktop-app control.
• A device appearing in the account center does not mean that it uploaded a local knowledge base.
• Never share login callbacks, one-time authorization results, or cookies.