Signed-in devices and sign-in emails

See where you're signed in

Open Settings → Security and find Signed-in devices. Each row is one place your account is signed in, shown as a browser and a system, such as "Chrome on macOS", with when it signed in, when it was last active, its IP address and the approximate country that address is in. The device you're using now is marked This device.

The IP address and country are where the device was last active, so a laptop that signed in at home and has since been used on a trip, or on a VPN, can show a different country from its sign-in email. The country is worked out the same way as in the email (see below). When it can't be worked out, the row shows just the IP address.

The label is only the browser and the system. Hourari doesn't fingerprint your device, so two laptops running the same browser and system look the same in the list.

Sign a device out

• Sign out on a row ends that one session.
• Sign out other devices ends every session except the one you're using. It only appears when you're signed in somewhere else.
• Sign out of all devices ends every session, including this one, so you'll be taken back to the sign-in page.

A device you sign out can't renew its session, but the access it already has lasts until it expires on its own. In practice, a signed-out device stops working within the hour.

Sessions also end without you doing anything: after seven days, or after eight hours without use.

The new sign-in email

When your account signs in from a browser and system it hasn't used before, Hourari emails you a "New sign-in to Hourari" notice. It shows the device, the time, the country the sign-in came from and the IP address, and links to your signed-in devices.

The country is approximate. It comes from the IP address, so a VPN, a work network or a mobile carrier can make a sign-in look as if it came from somewhere you aren't. If the device and the time are yours, a surprising country usually means one of those. When the country can't be worked out, the email shows just the IP address. Hourari looks the country up on its own servers from IP location data by DB-IP.com, so your IP address isn't sent to anyone else to do it.

• Your first device doesn't send one. The first time you sign in on the Hourari website, that browser is simply remembered.
• Browser updates don't send one. Versions are ignored, so Chrome updating itself is still the same device.
• A different browser or system does. Signing in with Firefox on a laptop where you normally use Chrome sends one, and so does your phone the first time.
• The same browser on another computer doesn't. A second Mac running Chrome looks the same as the first, because only the browser and system are compared.
• Each browser and system is reported once. After that it's a known device.
• It can't be turned off. Someone who had taken over your account could otherwise switch it off, so it goes to every account.

The email is sent however the sign-in happens: on the Hourari website, or by a program signing in with your password without ever opening the site. A sign-in on the website is reported straight away, and any other within about five minutes. Only the browser and system are compared, so a program that presents itself as a browser and system you already use isn't reported. It's an early warning, not a guarantee that every possible access is reported.

If a sign-in wasn't you

1. Change your password. In Settings → Security, use Change password. If you can't get in, use Forgot password? on the sign-in page. If you sign in with Google or Microsoft, change the password for that account instead.
2. Sign the device out. Use Sign out on its row, or Sign out other devices to end every session but yours. Don't rely on a new password alone to end sessions that are already open.
3. Turn on two-factor authentication in Settings → Security, so a password alone isn't enough to sign in next time.

If anything looks wrong after that, contact us at hello@hourari.com.