Staying secure comes down to a few habits: protect your sign-in method, add two-factor authentication, sign out of devices you do not control, and look over your payments and shared links now and then.
Know how people can sign in
The web sign-in page offers Continue with Google, Continue with Apple, Continue with Microsoft, Continue with phone, or an email address. Phone sign-in sends a verification code by text message, and email sign-in sends a link that the page says expires after 1 hour. The page has no password field.
Because you sign in through one of those, keep them secure: your Google, Apple or Microsoft account, your phone number and your email inbox.
Turn on two-factor authentication
Two-factor authentication adds a second check on top of your sign-in method: after you sign in, ZeroTwo asks for a 6-digit code from your authenticator app. Switch it on under Settings, Security, Two-factor authentication. The full steps, and what to know about backup codes, are in turning two-factor authentication on or off.
Sign out where you should not stay signed in
- Choose Log out in the account menu (your name at the bottom of the sidebar) when you finish on a shared computer.
- In Settings, Security, Log out of this device signs out only the session you are using.
- Log out of all devices signs out every session, including the current one. Other devices can take up to 30 minutes to be logged out.
Look over your payments
Settings, Billing, Transaction history lists your payments with their dates, statuses and amounts. A charge you do not recognize is a reason to act: see what to do about suspicious activity.
Review what you have shared
Anyone with a shared link can view the chat, post, image or file it points to. In Settings, Data Controls, Shared Links, select Manage to see everything you have shared and delete links you no longer want. Deleting a link stops others from viewing that content and does not delete the original.
Be careful with messages that mention ZeroTwo
You get a sign-in link or code when you enter your email address or phone number on the sign-in page. If a message or page you did not expect claims to be from ZeroTwo, go to the app directly instead of following it. How to tell if a message is really from ZeroTwo lists the official addresses.
If something looks wrong
Follow the steps for suspicious activity, then contact support with the details.