Paired devices

Your account page lists the devices paired with your account: Macs running Nova, and phones paired with them. Each entry shows the name, the kind, when it was last seen and the start of its certificate fingerprint.

A device registers itself when you sign in inside Nova, or when a phone pairs with a Mac. Nothing appears here because you opened the website in a browser — a browser is a session, not a device, which is the distinction the rest of this article turns on.

Revoking a device

Revoke next to a device marks it revoked immediately. The next time that device tries to write anything to your account — a bookmark, a setting, a tab list — the write is refused with “This device was revoked. Pair it again to keep syncing.” There is no waiting for a token to expire.

Revoked devices stay in the list, labelled, rather than disappearing. A device that vanishes tells you nothing about whether it was ever there.

To use the device again, pair it again.

The limit, stated plainly

The device id on a sync write is supplied by the device. An honest client sends its own id; a hostile one can leave it out. So revoking reliably stops the case the feature exists for — a Mac you sold, a phone you lent out, a machine you no longer control — and it does not by itself lock out someone deliberately working around it.

If you think a device is in someone else’s hands and they mean you harm, do all three:

1. Revoke the device.
2. Sign out other sessions, on the same page.
3. Change your password, which invalidates what is left.

Why there is no list of browser sessions

The account page offers Sign out other sessions rather than a list of sessions with a revoke button beside each. The authentication service has no self-service way for your browser to enumerate your own sessions — that data is reachable only with an administrative key, which a browser must never hold. A list built from data we cannot actually fetch would be a decoration that looks like a control, so the real capability is the one that shipped: end every session except this one.

If you cannot reach the account page

An administrator can revoke a device on your behalf — for a stolen laptop, or when you cannot sign in at all. It requires a reason and is recorded in the audit log. Ask through the contact form.

Revoked devices are included in your data export, with the date they were revoked. See Export or delete your data.