# Decide who can open your software

New customer-hosted projects start private to the MovePacket account that owns them. Your own project does not need a second email address, password or separate account.

## Open a private project

Open its address from your MovePacket project. If asked, choose **Continue with MovePacket** and use your existing owner account. Signing in with a different account does not grant access to this project.

If an old sign-in return link has expired, reopen the project's normal address and start again. You should not need to create a new account for that address.

## Publishing and sharing are separate

**Publishing** changes the files at your project address. **Making public** changes who can open those files. A published private project is still private.

Find the audience controls on the project's **Foundation** (**Project options → Foundation**), under **Your project details → Publishing, updates & recovery**. **Make public…** requires a separate confirmation. It exposes the whole published project and its assets, not just the page you are looking at. **Make private** restricts future access; it cannot recall copies someone already downloaded.

## Choose the right audience

| Content | Current approach |
| --- | --- |
| Your own dashboard, draft report or private race preparation | Keep the hosted project private to your account |
| A public calculator or example with no confidential data | Review the files, then explicitly make the hosted project public |
| A personal report for one athlete | Do not make the whole project public; recipient-specific sharing is not available yet |
| A public landing page with a private athlete portal | Requires additional application and access work; mixed public/private routes are not provided by the current project toggle |

Knowing the URL is not an access grant for a private hosted project. Conversely, a public URL is not made private by being difficult to guess.

## Athlete accounts are a separate capability

Your MovePacket account sign-in protects your workspace and owner-only hosted projects. It does not create athlete invitations, athlete signup or a portal where each rider sees only their records. Those features still need to be implemented and tested before use.

An API grant also does not create a person's login. Your builder must enforce the right resource-level access in any application it creates.

## Keep previews and exports private too

Saved hosted-update previews remain owner-only. Generated **Publish a page** snapshots are a separate sharing flow; use them only for content suitable for that audience. Downloads and recovery packages may contain private material even if they contain no credentials. Store and share them accordingly.

Read [API authentication](/docs/authentication) for the technical boundaries and [Privacy operations](/docs/privacy-operations) for restriction and export tools.