Account emails + password reset

Story

TRAX emails you only when something about your account needs you: confirming your email, trial reminders, receipts, payment problems, plan changes, and password resets. Each email says why you got it. Forgot your password? A one-hour, one-use link gets you back in, and signs out everywhere else.

Specifications

• Emails (28):
• confirm your email
• account already exists
• trial started
• during the trial: tips on days 3 / 7 / 14 and reminders 7 / 3 / 1 days before the end (days 23 / 27 / 29), "Subscribe to continue" the day it ends (soft launch schedule; the 14-days-left reminder is retired)
• after an unpaid trial (paused, never deleted): the day after (work kept 90 days), days 7 / 30 / 60 / 85, a final notice on day 90, "archived" on day 97 (recoverable for a year by subscribing or replying)
• welcome (subscribed)
• receipt
• payment failed
• bank confirmation needed
• plan changed
• cancellation scheduled
• subscription ended
• password reset
• password changed
• Format: plain text plus simple HTML (one button, works in every mail app). Names are escaped, and only http(s) links become buttons.
• Delivery:
• sent through Resend straight away when queued; a failed send gets another try at the next send run at least 5 min, 30 min, 2 h and 12 h later (the daily job, or Admin → Emails → Send queued now), then it's marked failed
• the trial and paused-account emails are queued by the daily job and sent at the end of it (each run sends for up to 45 seconds; the rest go next run); only accounts within 100 days of their trial's end are looked at
• a reset or confirm link that expired before it could be sent, a trial tip, reminder or paused-account note more than 36 hours late (or a paused-account mark missed by more than 2 days), and anything queued more than 7 days ago are skipped, not sent
• White Label waitlist: a confirmation to them and a notification to Bianca
• each email is sent once (deduplicated per moment, Resend idempotency key)
• the link is cleared from TRAX's copy once sent
• test accounts and test addresses (example.com, .test, .invalid) are never mailed
• Password reset:
• by email or username, for accounts with an email on file
• the link works once, for 60 minutes; only a SHA-256 of it is kept
• same answer whether or not an account exists, after the same minimum time (2 seconds); the email is sent in the background
• at most 3 links per account and 10 per network per hour (counted after each request is recorded, so requests sent at once can't get round it)
• a link stops working if the login is turned off before it's used
• new password at least 12 characters
• every session from before the reset is signed out, and a "password changed" email follows
• Clean-up: reset links older than 30 days are deleted by the daily job.
• Admin: Admin → Emails shows whether sending is on, the database updates, queued / sent / failed counts, the latest emails (addresses masked), "Send queued now", and a preview of every email.

How to

1. On the log-in page, choose Forgot your password?
2. Enter your email or username.
3. Open the link in the email (within an hour) and choose a new password.

What you can do

• Get back into your account without anyone's help, securely.
• See exactly why each email was sent. None of them are marketing.

What you can't do (yet)

• Reset a password for a login with no email on file. Ask the person who set it up, or reply to any TRAX email.
• Choose which account emails you get. They're all about your account, so they all go out.
• Receive emails by text message (SMS is planned).

Plans

• Producer Starter: every account email, and password reset.
• Pro Studio: the same.
• Label Enterprise: the same.
• White Label (by waitlist): the same.

Related

• Trust: Resend is listed among the services TRAX uses once sending is switched on.

Changelog

• 1.17 · 2026-10-02: The soft launch's email schedule: trial tips on days 3, 7 and 14; reminders on days 23, 27 and 29; then, for a paused account, notes on days 1, 7, 30, 60 and 85, a final notice on day 90 and "archived" on day 97 (nothing deleted). White Label waitlist emails (a confirmation and a notification).
• 1.16 · 2026-10-02: Account emails through Resend, and "Forgot your password?" (switched on once the email domain and database updates are in place).