Security & Performance Focused

This is one of the larger releases since we launched with a heavy focus on performance and security improvements. While I’ve deployed a number releases since launch, this is the first I’ve started publishing. It includes:

• new plans and a new billing system
• saved views and a configurable Home button
• workspace and account export
• view-only accounts for people you share with
• a new sign-up experience
• much faster loading
• a broad set of security and reliability improvements

Before You Start: Sign In Again

Sign-in now runs on Opal’s own sessions. Because of this change, everyone who signs in with an email and password has been signed out once. Sign in as usual. Nothing in your account has changed.

• Password resets: reset links sent before this release no longer work, so request a new one from the sign-in page. New reset links expire after one hour and work once.
• Staying signed in: sessions last up to six months and are renewed while you use Opal, so you stay signed in as long as you keep using it.

Plans and Billing

New Plans

	Day Desk	Studio	Workshop
Billed monthly	$9 / month	$27 / month	$47 / month
Billed yearly	$7 / month	$21 / month	$37 / month
Workspaces	1	3	7
Items	250	1,000	5,000
Storage	250 MB	1 GB	5 GB
Largest file	5 MB	25 MB	50 MB
Publish individual items	✓	✓	✓
Share and publish binders; publish fences		✓	✓
Integrations (CrushTheMemory)		✓	✓
REST API			✓

If You Already Have a Plan

• Your plan’s name: Core Essentials is now shown as Studio, and Complete System as Workshop.
• Your limits and features stay the same:
  • Core Essentials: 5 workspaces, 1,000 items, 5 GB of storage and 25 MB files.
  • Complete System: 10 workspaces, 5,000 items, 25 GB and 50 MB files.
• Your subscription and price stay the same. If you switch to one of the new plans, that plan’s limits and price apply. The older plans are no longer offered.
• Free Mode accounts keep their current limits. New accounts can’t choose Free Mode.

Billing

• Checkout: plans are bought through Stripe Checkout. Your plan is applied as soon as the payment is confirmed, even if you close the tab.
• Manage Billing (Plan & Billing) opens your own billing page. There you can:
  • update your card
  • see your invoices
  • switch plans
  • cancel
• Switching plans:
  • Upgrades take effect immediately, prorated.
  • Downgrades take effect at the end of your current billing period.
• Above the new plan’s limits after a downgrade: nothing is deleted. You can’t create new items or workspaces until you’re within the new plan’s limits.
• Binders and fences after a downgrade: those you’ve already shared or published stay as they are. If the new plan doesn’t include sharing and publishing them, you can’t share or publish new ones.

When a Plan Ends

When you cancel, your plan keeps running until the end of the period you’ve paid for:

• A banner shows the end date.
• A confirmation email goes out when you cancel.
• A reminder goes out three days before the end.

When a plan ends, your account becomes view-only. It no longer drops to Free Mode, and nothing is deleted.

• What you can still do:
  • view, search and export everything
  • use read-only API keys
• What stops:
  • creating, editing, deleting, uploading, sharing and publishing
  • integration syncing
• What you’ve shared: people you’ve shared with see your content as view-only.
• Published pages: they stay online for 30 days. After that they show an “unavailable” page.
• Your data: we keep it for 12 months. We email you 30 days and again 7 days before anything is deleted.
• Resubscribing at any point in those 12 months restores everything immediately, published pages included.

When a payment fails, you keep full access while Stripe retries the charge. A banner asks you to update your card. If every retry fails, the plan ends as described above.

Deleting Your Account

You can now delete your account yourself, under Account & Profile → Delete Account. You confirm by typing your email address.

• What’s deleted, permanently: your workspaces, items, uploaded files, tasks, contacts, shares, published pages and API keys.
• Your subscription: it’s cancelled right away, with no refund for the rest of the current period.
• Keeping a copy: the confirmation dialog offers an export before you delete.

Saved Views, Home Button, and Fence Focus

• Saved views: a new View button sits next to Home. It saves where you are and how far you’re zoomed in, so you can jump back there later from any workspace.
  • You can name a view and remove it.
  • On screens 1024 pixels wide and narrower, Home moves into the View menu as its first entry.
• Home button and first view: set these under Account & Profile → Home Button and First View.
  • My Home Button Points To: True Home, or any saved view.
  • After Login, Show: one of the following. This applies each time you open Opal in a new tab or window.
    • Where I left off (the default)
    • Everything at a glance
    • What my home button is set to
• Fence Focus & Zooming:
  • Double-clicking on a fence label will automatically set the zoom to 100% and center that fence on your screen. If the fence is too large to fit on your screen, the fence label will be positioned near the top left of your screen.
  • After double-clicking a fence level to zoom and focus on it, if you double-click on the same fence label again (without panning or zooming in between), your previous zoom and pan position will be restored.

Export

• Export Everything (Account & Profile → Your Data) downloads your whole account as a zip file, once a day.
• Export this workspace (Edit Workspace) downloads a single workspace, as often as you like.

What’s in the zip:

• Workspaces: a folder for each workspace, plus your Inbox.
• Notes and documents: saved as Markdown, next to your uploaded files. Binder contents go in a folder named after the binder.
• Images inside documents: saved alongside each document and linked to it, so the export doesn’t depend on links that expire.
• Tasks and contacts: a full export also includes Tasks.md and Contacts.json.
• Files that couldn’t be downloaded: listed in the zip.

The zip is built on the server and streamed straight to your browser, so large accounts export reliably. Export also works on view-only accounts.

Sharing

People Without an Opal Account

• The invitation: when you share an item with someone who doesn’t have an Opal account, their invitation lets them create a no-cost, view-only account, with a password or with Google.
• Accepting:
  • Shared items arrive as requests they can accept.
  • A view-only account can accept up to five shared items and copies.
  • Binders need a Studio or Workshop plan.
  • They can upgrade to a paid plan from inside Opal at any time.
• Copies: sending a copy to an email address without an account sends the same invitation.

Permissions

• When you share onward an item that was shared with you, you can grant only the permissions you hold.
• Only an item’s owner can change a recipient’s permissions.
• Only the person a share was sent to can accept or decline it.
• When an owner’s account becomes view-only, everything they’ve shared becomes view-only for collaborators, and collaborators can’t share it onward.

Binders With Other People’s Items

The binder setting “Assume delete capabilities and ownership of items of removed participants” now also decides what happens to participants’ items when a binder is deleted.

What you do	Setting on	Setting off
Delete Everything	Participants’ items are deleted too.	Participants’ items go back to their owners.
Delete Only The Binder	Participants’ items become yours and stay next to the binder.	Participants’ items go back to their owners.

The delete dialogs now spell out which of these will happen.

When items become yours, by either route, their files and image icons move into your storage, as far as your plan’s storage has room. This applies whether you delete the binder or remove a participant while the setting is on.

• Items that don’t fit stay with their original owner.
• Opal tells you how many items it couldn’t take.

A New Sign-Up Experience

New accounts now start at /register with a short set of questions about how you work:

• Your plan: the questions lead to a recommended plan, though you can choose any plan.
• Payment and access: you pay through Stripe Checkout, then set a password or continue with Google.

Your new account starts with:

• a workspace at the address you chose
• the starter fences you picked
• a saved view, if one fits your answers
• a welcome email with a tip for getting started

If your email address already has an account, Opal sends you to sign in instead.

Faster Loading

We measured on a test workspace with 1,500 items:

	Before	Now
Whole workspace on screen	6.6 seconds	about 2.4 seconds
Data downloaded	23.5 MB	about 3 MB

• First items: they now appear in about a second, or under 2 seconds on a 25 Mbit/s connection.
• Returning: a workspace you’ve opened before in the same browser appears in about half a second.

What changed:

• Opal asks for your workspace’s items the moment the page opens.
• It downloads card previews instead of every item’s full content.
• It compresses what it sends.
• It draws what’s on screen first.
• It keeps a copy of the workspace in your browser.
• It loads items shared with you in batches.

When a new version of Opal is released while you have it open, a bar now says “Opal has been updated” and offers to reload. You’ll see this from the next release on.

Content Limits

• Item size: an item’s content can be up to 2 MB, and up to 1 MB of text is kept inline.
• Larger text files: these upload as downloadable files instead of being converted into documents. This covers Markdown, CSV, logs, code and other text formats.
• Saving past the limit: you get a message explaining why the change can’t be saved.
• Large workspaces: workspaces holding very large items now load reliably.

Fixes

• Items in the Inbox open again on click or double-click.
• An image thumbnail problem that could interrupt service has been fixed.
• Published fences are easier to see on published pages.
• Items in binders on published pages show the correct hover style.
• The icon picker works on newly created workspaces.
• Saving no longer overwrites other recent changes to the same record. For example:
  • Editing a task in the app no longer removes the item it’s linked to.
  • Saving your profile no longer undoes a view you saved in the meantime.
  • Storage usage is counted accurately after server restarts. It includes media inside documents and updates as soon as files are deleted.
  • A deleted item’s published page now goes offline.
  • New accounts open on their workspace.
  • Upload and storage limit messages state your plan’s actual limits.

Security

This release includes a broad security review and the fixes that came out of it, across:

• sign-in
• sharing
• file storage
• billing
• the REST API

Moving sign-in to Opal’s own sessions, described at the top of these notes, is part of that work.

REST API and Agent Skill

The REST API is included with Workshop and Complete System. All endpoints are under https://app.opalrecall.com/api/v1.

New

• GET /account: your plan, limits, usage and account status, including whether the account is view-only and when its data would be deleted.
• Saved views:
  • GET /views, POST /views, PATCH /views/:id and DELETE /views/:id.
  • PATCH /views/settings sets the Home button target and the first view.
• Export: GET /export/check and GET /export, with the same rules as the app.

Changed

• POST /workspaces:
  • Now works.
  • slugPrefix is optional and comes from the name when left out.
  • Addresses are validated (400), and an address that’s already taken returns 409.
• DELETE /workspaces/:id now deletes the workspace’s items too.
• Deleting a binder follows the binder’s ownerControlsItems setting, as in the app. The response adds releasedItems, returnedItems and notTakenItems.
• DELETE /shares/:id on a binder share handles the participant’s items the same way, and returns itemsNotTaken.
• POST /items/:id/binder/items refuses binders and fences (400 CONTAINER_IN_BINDER). Filing a shared binder into a binder is refused too.
• GET /items/inbox includes items moved there with PATCH /items/:id/inbox.
• POST /media/upload:
  • It works on an item that has no content yet.
  • Given an itemId, it requires edit access.
• GET /tasks?date=all lists every task.
• Share permissions:
  • Only the owner can change them.
  • Sharing onward grants only permissions you hold.
  • 400 responses explain what to change.
  • Declining a share you’ve already accepted returns 409.
• View-only accounts:
  • Reads keep working.
  • Every write returns 403 ACCOUNT_LOCKED.
• Oversized item content returns 413.
• Test keys: new opal_test_ keys can no longer be created.

Documentation

The REST API reference has been rewritten against the current code. The Opal Recall Agent skill, which lets AI assistants work with your Opal account through the API, has been updated to match.