How to manage your account security settings

Q: What does "Account protection" count?

The readout at the top of Access and security counts two checks and reads Account protection: {done} of {total} — "Account protection: 2 of 2" when both are met: Two-factor authentication — Two-factor authentication on, or Two-factor authentication off while it is not. A way in that does not hang on one external account — met when your account has a password, or more than one external account linked: You don't depend on a single external account. With neither, it reads You sign in only with an external account. While a check is missing, the readout carries one button for the step to take, and it takes you to Access: Turn on two-factor authentication when two-factor authentication is off — that one comes first — otherwise Set a password.

Q: How do I disconnect my Google account?

In Connected accounts, press Disconnect on the Google row. With no Google account linked, the section reads "You haven't connected any external accounts." An account always keeps at least one way in, so the last one cannot be disconnected. When Google is the only sign-in method on your account, its row shows no Disconnect button: it reads "It's your only way in. Set a password to be able to disconnect it." Set a password first, on the Password row under Access, and the Disconnect button appears on the Google row. Signing in with Google in the first place is covered under passwordless sign-in.

Q: What is on the Privacy and data page?

Three sections, from top to bottom: Cookie consent, Privacy — only for a visitor covered by US state privacy law — and Delete account. Where do I change my cookie consent? In Cookie consent, press Manage cookie preferences. It opens your cookie preferences, where you can switch any optional purpose on or off, and it is there for every signed-in user in every country. What each purpose covers: how cookie consent works. Why is there no Privacy section on my Privacy and data page? The Privacy section appears only for a visitor covered by US state privacy law, and holds the "Your Privacy Choices" opt-out that law grants. Anyone else never sees it — not even an empty heading. Who sees it and why: Your Privacy Choices and Notice at Collection. How do I delete my account? In Delete account, at the bottom of the page. Deletion is scheduled 14 days ahead rather than immediate, and during that window you can cancel it with Keep my account — signing back in alone does not cancel it. What is deleted, what is anonymized, and how to cancel: account deletion.

Guide5 min5 steps

You manage how you sign in — your password, two-factor authentication, Google and the browsers signed in to your account — on Settings → Access and security; cookie consent and account deletion are on Settings → Privacy and data.

Steps

Open Settings, then Access and security. You need to be signed in. The page opens with the Account protection readout — Account protection: {done} of {total} — then Access, Connected accounts and Active sessions.
To change your password, select Change password on the Password row under Access. It asks for your Current password and the new one twice, and changing it signs out every other browser signed in to your account — see active sessions. An account that has never had a password — every new account, since accounts are created with Google or with an emailed link or code — shows "You don't have a password yet. We'll email you a link to set one." instead, with Send reset link: open the emailed link and choose a password. What a password must contain: passwordless sign-in.
To turn on two-factor authentication, select Enable 2FA on the Two-factor authentication row. Fincanva first asks you to confirm it's you — with your password, or with an emailed link if your account has none — then walks you through three steps: scan the QR code with your authenticator app, enter its 6-digit code, and save your backup codes. Once it is on, the same row offers Generate new backup codes and Disable 2FA. How the second step works at sign-in, and what to do if you lose your phone: two-factor authentication.
To sign a browser out, select Sign out on its row in Active sessions, or Sign out all other sessions to end every session except the one marked This device — confirmed with Sign out others.
For cookie consent, the US privacy choices and deleting your account, open Settings, then Privacy and data — see What is on the Privacy and data page?

Done. Each change applies when you confirm it, and a message names it: Password changed, Password link sent, Account disconnected, Device signed out or Signed out of your other devices.

What does "Account protection" count?

The readout at the top of Access and security counts two checks and reads Account protection: {done} of {total} — "Account protection: 2 of 2" when both are met:

Two-factor authentication — Two-factor authentication on, or Two-factor authentication off while it is not.
A way in that does not hang on one external account — met when your account has a password, or more than one external account linked: You don't depend on a single external account. With neither, it reads You sign in only with an external account.

While a check is missing, the readout carries one button for the step to take, and it takes you to Access: Turn on two-factor authentication when two-factor authentication is off — that one comes first — otherwise Set a password.

How do I disconnect my Google account?

In Connected accounts, press Disconnect on the Google row. With no Google account linked, the section reads "You haven't connected any external accounts."

An account always keeps at least one way in, so the last one cannot be disconnected. When Google is the only sign-in method on your account, its row shows no Disconnect button: it reads "It's your only way in. Set a password to be able to disconnect it." Set a password first, on the Password row under Access, and the Disconnect button appears on the Google row. Signing in with Google in the first place is covered under passwordless sign-in.

How are my devices named in Active sessions?

Each signed-in browser is named by its browser and operating system, in your interface language — {browser} on {os} in English, so "Chrome on macOS". The browser and system names themselves are never translated. When only one of the two is recognised, the row shows that one alone — "Chrome", or "macOS" — and when neither is, "Unknown device". What a session is: active sessions.

What is on the Privacy and data page?

Three sections, from top to bottom: Cookie consent, Privacy — only for a visitor covered by US state privacy law — and Delete account.

In Cookie consent, press Manage cookie preferences. It opens your cookie preferences, where you can switch any optional purpose on or off, and it is there for every signed-in user in every country. What each purpose covers: how cookie consent works.

Why is there no Privacy section on my Privacy and data page?

The Privacy section appears only for a visitor covered by US state privacy law, and holds the "Your Privacy Choices" opt-out that law grants. Anyone else never sees it — not even an empty heading. Who sees it and why: Your Privacy Choices and Notice at Collection.

How do I delete my account?

In Delete account, at the bottom of the page. Deletion is scheduled 14 days ahead rather than immediate, and during that window you can cancel it with Keep my account — signing back in alone does not cancel it. What is deleted, what is anonymized, and how to cancel: account deletion.

← PreviousHow cookie consent works on Fincanva Next →How to manage your notification settings

UPDATED 2026-10-08REVIEWED 2026-10-08