Skip to documentationAccounts & profiles
Wallet and social sign-in, embedded wallets, public profiles and linked-account controls.
On this page
Sign in with a wallet or a linked provider
Sinjoh accounts support Wallet, X, GitHub and Google sign-in. Google includes Google accounts using Gmail. Social users without a wallet receive an embedded EVM wallet through Privy. Apple sign-in is deferred and is not presented as an enabled method.
Connecting an existing wallet and creating an embedded wallet are different paths. Linking another sign-in method does not transfer funds or combine all wallet balances. The selected Portfolio wallet determines which address is read and, where transactions are available, which wallet signs.
Public profile fields
| Field | Visibility / behavior |
|---|---|
| Display name | Public profile identity. |
| Username | Unique normalized handle and /u/{username} public profile. |
| Profile picture | Public image; editable through the account/avatar controls. |
| Bio | Public profile description. |
| Linked X / GitHub handles | Public icons link to verified linked profiles in a new tab. |
| Email / provider subjects | Private; excluded from public profile responses. |
Linking and unlinking
Linked methods are shown in Sinjoh green. Selecting a linked button presents its unlink option; an unlinked button starts the provider’s linking flow. Privy’s existing identity and embedded-wallet rules still apply. Unlinking X/GitHub removes the corresponding public profile link on synchronization.
The account’s avatar opens its view/edit controls. Edit opens profile management; Sign out sits beneath it. Wallet export, when available for an embedded wallet, uses Privy’s isolated private interface. The application does not ask users to put recovery phrases into profile fields.
How profile writes are authorized
The server verifies the authenticated Privy subject and signed identity data before synchronizing or changing that user’s record. Public reads explicitly select public fields. Avatar writes use owner-specific storage paths and supported images are re-encoded. Browser database writes are denied; server-side database credentials are not returned to the browser.