If you think your PoolStamp account has been compromised (stolen phone, shared password, ex-employee you forgot to remove), you can rotate credentials and end every active session yourself.
Reset the password
From the web admin, Settings → Security → Change password. If you can't sign in, use the "Forgot password?" link on the login screen — you'll receive an email with a signed link, good for 60 minutes. Setting a new password does not automatically end other sessions.
Kill every active session
Settings → Security → Active sessions lists every device with a valid session token — the browser or mobile app, the last-used timestamp, and the device model. Two options:
- Revoke one — kills the token for a single session (useful for "I left my session logged in on my brother's laptop").
- Revoke all sessions — kills every session including the one you're using. You'll be signed out immediately and need to sign in fresh.
Choose Revoke all for anything that could be a real compromise. It's the belt-and-suspenders move: rotate password + kill sessions.
What happens under the hood
Sessions are validated per request against a server-side allowlist. Revoking flips that entry to revoked in the same second. Any request in flight from a revoked session gets a 401 on its next call, and the client is forced back to sign-in. There is no cached credential a revoked token can fall back to.
Reset an ex-employee's access
Go to Team → Members, tap the ⋮ menu next to their name, and choose Remove from org. Their membership drops immediately, all their sessions are revoked, and their receipt-viewing links continue to work only for the customers the OWNER inherits.
Password strength
PoolStamp enforces at least 12 characters. We recommend a passphrase (three unrelated words + a number, e.g. river-orange-guitar-42). Passwords are hashed with bcrypt at cost factor 12 — the plaintext is never stored.