I no longer have access to my email or my phone number

Losing access to both your email and your phone number is not a dead end. Noryo lets you recover your account by proving that you are its owner, then replacing the lost factor with a new email or a new phone number. This is not about resetting a mere password, but about durably regaining control of your account.

The three steps of recovery

Recovery always follows the same order: you identify the account by entering the old email or phone number, you prove that it is really you, then you replace the lost factor. Until you have proven your identity, the screen never confirms whether an account exists or which methods are attached to it: this protects you against guessing attempts.

To prove your identity, several means are possible depending on what is available on your account:

• A backup code: generated in advance, single-use, to be kept off your device.
• An approval from another device already signed in: a request is sent to an eligible device; by approving it, that device signs a proof with its secure key (Secure Enclave). A lost, revoked device, or one whose key has been removed, cannot approve.
• A passkey: a strong method that authenticates you directly and lets you replace the lost factor.
• Face ID or your Noryo Code, on a device already linked: Face ID then unlocks that device's cryptographic key (biometrics only, never your iPhone's unlock passcode). It is a presence layer added to possession of the device, never a proof on its own; the Noryo Code, specific to the app and verified by the server, serves as a fallback to biometrics. On a new or unknown device, Face ID grants no recovery rights.
• The password: only if your account has no strong method.

Don't have a backup code? The option "I don't have a backup code" simply opens the other available means: it is never a dead end.

If no automatic method works

As a last resort, an exceptional recovery can be requested. It never grants access automatically: it opens a case. The request is verified by your trusted contacts (a quorum of 2 out of all those you have designated) and an unavoidable 72-hour security delay applies. As soon as the case is opened, the account owner is notified and receives a "This wasn't me" link that permanently freezes the request. Support has no magic button: no one can bypass these checks.