Technical reference. For task-based help, see the corresponding user guide.

Documentation status: complete for the current implementation

Reviewed: 2026-07-21

Primary users: family members and coaches

Surfaces: mobile web app, coach admin portal and platform API

This feature lets a signed-in person maintain the identity and preferences attached to their account. It covers family and coach profile details, private profile media, family timezone, appearance, communication choices, password changes, legal links, logout and permanent family-account deletion.

Baby profiles have a separate lifecycle and are documented in Feature 06. Practice-wide branding and team labels are documented in Feature 23 and Feature 26.

1. Name is required and trimmed by the platform before it is stored.
2. Email identifies the authenticated account and is read-only in this editor.
3. Relationship can be Mother, Father, Grandfather, Grandmother, Uncle, Aunt, Guardian or Other.
4. Selecting a profile image creates an immediate local preview, then uploads the image to the private profile-images bucket through a short-lived signed upload URL.
5. Saving sends only trusted profile fields to PATCH /auth/profile. A signed download URL is requested when the image is displayed later.
6. A failed image upload leaves the existing profile usable and reports a retryable error rather than saving a broken public URL.

1. The mobile editor requires the coach name and, when the business-name field is available, the business name.
2. The coach portal calls the same profile endpoint and requires both Coach name and Practice name.
3. A coach can select or remove a square image/logo. The portal validates that the chosen file is an image, compresses supported formats, obtains a 15-minute signed upload, and saves the resulting private object path.
4. Updating businessName changes the owning coach's practice/organization name as part of the trusted platform profile operation.
5. The coach email is displayed but cannot be changed from these screens.

The mobile settings screen exposes the app theme preference and its resolved appearance. This preference is a client presentation choice; it does not grant access or alter server data.

1. The family can choose an IANA timezone from the settings list or use the timezone detected from the current device.
2. Saving calls PATCH /auth/profile with the current profile name and chosen timezone.
3. The timezone defines the family's day boundary and the times shown to coaches.
4. Existing activities retain the timezone/local-date metadata captured when they were written; changing the family timezone does not rewrite historical logs.
5. The update button is disabled until the value changes. Success and recoverable failure messages are announced on the page.

Three independent, opt-in switches are available:

• hints and tips;
• app updates and new features;
• promotions and offers.

All three default to off. The screen refreshes the current trusted session before editing, sends a partial strict request to PATCH /auth/communication-preferences, and updates its saved baseline after success. A network or API error leaves the draft visible for another attempt.

1. Family and coach password forms require the current password, a new password of at least eight characters and matching confirmation.
2. The coach portal hides the password inputs until Update password is chosen and reports when password updates are unavailable in the current auth environment.
3. Password changes are handled by the authenticated Supabase client; passwords are never sent to the Littles Baby Tracker profile endpoint.
4. Terms and Privacy screens load the configured public document URL in an iframe and provide an explicit external-open button if the embedded view is unsuitable.
5. Logout clears local product state and signs out the Supabase session even when a remote sign-out response cannot be completed. It does not delete product data.

Deletion is intentionally available only in the family's self-mode menu. It is not shown while a coach is viewing a family and is not a general coach-admin action.

1. The screen states that the family profile, babies, activities, allergy ladders and coach access will be removed and that the operation cannot be undone.
2. The user must enter the account email; comparison is case-insensitive and must match the signed-in subject email.
3. The user must also type the exact uppercase confirmation word DELETE.
4. DELETE /auth/account repeats schema and identity checks on the server. The API removes the product account and asks the auth administrator to remove every linked auth identity returned by the deletion transaction.
5. On success the app logs out and returns to the signed-out flow. On failure the destructive form remains open and displays the platform error.

Current implementation note: family self-service deletion is reachable in mobile. The coach portal currently provides profile, image and password management but no coach self-delete control.

1. Supabase Auth remains the identity/password authority; the platform API remains the profile and tenant authorization boundary.
2. Private storage paths, not public image URLs, are saved in profiles. Every upload/download request is scoped and re-authorized.
3. A coach viewing a family cannot edit the family's user profile, timezone, preferences, password or account lifecycle controls.
4. Business-name changes are limited to the coach owner context allowed by the platform.
5. Communication preferences are separate booleans and never inferred from accepting required legal terms.
6. Owner view-as sessions remain read-only for normal profile mutations.

1. A family can update name, relationship and profile image without changing its email identity.
2. A coach can update coach/practice names and add or remove a private profile image.
3. Family timezone changes affect future day-boundary behavior but do not rewrite stored activities.
4. Communication switches load their saved values and persist independently.
5. Password validation runs before the auth-provider call and a successful change clears the form.
6. Logout ends the local session without deleting data.
7. Account deletion remains disabled until both email and exact confirmation match, then signs the deleted user out.
8. Coach view-as never exposes the family's logout, password or deletion controls.

• mobile-web/src/routes/SettingsScreen.tsx
• mobile-web/src/components/FamilySideMenu.tsx
• mobile-web/src/components/CoachSideMenu.tsx
• mobile-web/src/routes/FamilyAccountActionScreen.tsx
• mobile-web/src/routes/ChangePasswordScreen.tsx
• mobile-web/src/utils/image-upload.ts

• admin-web/src/routes/AccountPanel.tsx
• admin-web/src/api/supabase-auth.ts

• platform/apps/api/src/routes/auth-routes.ts
• platform/apps/api/src/routes/file-routes.ts
• platform/packages/shared/src/auth.ts
• platform/packages/shared/src/communication-preferences.ts
• platform/docs/multi-tenancy/05-development-plan.md

• 01 — Account access, onboarding and sign-in
• 06 — Baby profiles and switching
• 23 — Practice settings and team labels
• 30 — Signed files and profile media