# App users and data

The accounts your app's users get, how sign-up is controlled, and what the Data tab shows.

## Accounts in your app

Apps from the App starter have accounts from the first build: email and password, **Continue with Google**, forgot password. An older project without accounts gets them from the **Add sign-in** button in the header.

Google sign-in uses Ripping's Google client by default, so Google's consent screen says Ripping. On the **Users** tab, **Use my own Google client** lets you paste a client ID and secret from Google Cloud (add the redirect URI shown there first); Google's screen then names your app. **Use Ripping's instead** switches back.

## The Users tab

Counts at the top: total users, new today, new this week, active this week (signed in in the last 7 days), Google sign-ins. A chart shows users over time by day, week or month. Sign-ups from the preview count too.

The table lists name, email, status, how they sign in, joined and last sign-in, with a search box. Per user:

- **Block**: they are signed out everywhere and cannot sign in until you **Unblock**.
- **Make admin**: an admin sees and changes everyone's shared records. **Remove admin** undoes it.
- Remove (the bin icon): deletes the account and everything they saved in the app.

### Who can sign up

- **Anyone**: anyone with the link can create an account. The default.
- **Approve new users**: people can sign up, then wait. They appear under **Waiting for approval** with **Approve** (they get an email, "You're in: *app*") or **Decline** (the account is removed).
- **Invite only**: only invited addresses can create an account. Others see "This app is invite-only. Ask its owner for an invite." Internal tools start in this mode.

### Invites

Enter emails separated by commas (up to 50) and press **Invite**. An invited address can sign up even when sign-ups are closed, and someone already waiting for approval is let in. If the app is deployed, each person gets an email with the app's link; if not, the message says "Deploy the app to email them a link". Pending invites can be removed.

### Limits

Your plan sets users per app (100 on Free, unlimited on Singularity). When full, a visitor sees "This app isn't taking new accounts right now."

## The Data tab

Two sources at the top:

- **Live**: what people saved in the deployed app, and in the preview when signed in.
- **Preview**: the preview's own local data. You can set, remove or clear keys; a turn that changes the sample data resets it.

**Live** lists shared collections with their rule, private data per person, and **Files** people uploaded, with storage used against your plan's limit. Pick a collection to see its records; edit one as JSON, delete it, or download the collection as **CSV**. Changes show in the live app right away.

**Structure** folds out at the bottom: fields and types, the SQL, and the database connection. **Add a database** connects your own Supabase project: Ripping proposes tables, you run the SQL, and the builder rewires the app.

## Shared collections in plain words

An app declares which data is shared and how in `src/lib/collections.ts`. Four rules:

- **public**: anyone can read. Signed-in people add and edit their own.
- **members**: signed-in people read everything and edit their own.
- **inbox**: visitors add without signing in; people see only their own. The app's admins see everything.
- **team**: shared within a team. Only the team's members read or write, and each record names its team. Teams and their members are collections too; membership is by email, so it applies the moment that address signs in.

Data the app keeps per account (a person's own todos, settings) is private: only they see it in the app, and it appears under **Private, per person** on the Data tab.

## The website inbox

A Website has no accounts. Its contact form writes to a `messages` inbox and its newsletter form to `subscribers`; the builder adds one inbox per extra form (a booking request, a quote). Each submission does two things:

1. It appears on the **Data** tab, where you read, export or delete it.
2. An email, "New message on *site name*", goes to every owner of your account with the fields as sent. Replying goes to the address the visitor typed, when they gave one.

The site itself never shows submissions to visitors.