v2.9.3 Two-step sign-in, and more control over who can reach your account
October 11, 2026
- Turn on two-step sign-in and confirm it is you with a code from an authenticator app, or with Face ID or Touch ID
- Disconnect Claude or ChatGPT in one click, and their access stops straight away
- Signing in with Google or Apple is safer, and Google only asks for your name and email
- New passwords need at least 12 characters, and your current password keeps working
- Repeated wrong passwords pause sign-in for a while, so nobody can keep guessing
New Features
- Two-step sign-in: Go to Settings, Sign-in & security to add an authenticator app (such as Google Authenticator, Microsoft Authenticator or 1Password), or Face ID, Touch ID or a security key. After you sign in with your password, Google or Apple, Clear Tangle asks for a 6-digit code or a quick Face ID or Touch ID check. It is optional, and you can remove it at any time. The iPhone and Android apps do not support it yet, so if you use them, wait for their next update before turning it on. If you lose the phone with your authenticator app, email support@cleartangle.com and we will help you back in.
- Disconnect an AI assistant: Settings, AI assistants now has a Disconnect button for each assistant you connected, such as Claude or ChatGPT. Its access stops straight away, even in a conversation that is already open. You can connect it again whenever you like.
Improvements
- Safer Google and Apple sign-in: Signing in with Google or Apple now finishes with a code that works once, for one minute, and only in the browser where you started. Google asks only for your name and email, and lets you choose which Google account to use.
- Longer passwords, no odd rules: New and changed passwords need at least 12 characters. There are no rules about symbols or numbers, so a short sentence makes a good password. Your current password keeps working.
- A pause after too many wrong passwords: After 10 wrong passwords in 15 minutes, password sign-in for that account pauses for a short while. You can still sign in with Google or Apple, or reset your password.
- A quick check before sensitive changes: Creating an API key or deleting your account asks for your password if you have not signed in recently.
- Your email stays private: The default project for a Gmail account has to be one of your private projects, so captured emails are never shared with a team unless you choose to share them.
- API keys that expire: New API keys last 90 days unless you choose otherwise, and at most a year. They work with your notes, tasks and projects, but not with your email, calendar or connected apps.
- Clearer team invitations: To add someone who is not yet in your organization to a project, you send them an invitation, which they accept. People already in your organization can still be added directly.