A complimentary Miracle account should be a deliberate gift, not a public link that can spread beyond its recipient. The owner can now send, monitor, renew, and revoke personal invitations from Admin without changing anyone's billing or administrator privileges. This release also fixes the travel decision that could say a time zone changed while the old zone remained in place.
A private invitation from start to finish
- Admin now includes a compact Complimentary accounts section where the owner enters the recipient's email address and sends the invitation.
- Each invitation is bound to that exact email address, expires after seven days, and can be accepted only once.
- The recipient signs in with the invited address and confirms acceptance explicitly. Opening the link alone does not consume it.
- If the wrong Google or email identity is active, Miracle offers a real account-switch path before acceptance.
- The invitation capability stays in the browser fragment during entry, is exchanged through a same-origin request, and is never stored in the database as a usable link.
Clear recovery and control
- A failed email delivery can be retried without creating a second invitation.
- Resending renews the seven-day window and invalidates the previous link.
- Pending invitations can be revoked before use, and accepted complimentary access can be revoked independently later.
- Admin keeps durable delivery, acceptance, expiration, and revocation status instead of hiding a failed row.
- Complimentary access is a separate entitlement. It does not pretend to be a Stripe subscription, start a trial, grant admin authority, alter existing paid membership, or delete the member's data when revoked.
Time-zone changes now persist
- Choosing the detected device time zone now changes the account even when a paid pact is active.
- Every paid pact keeps using the immutable civil clock accepted with its terms for completions, deadlines, evaluation, and billing.
- The successful server receipt updates the visible setting immediately, even if the follow-up refresh briefly loses its connection.
- A rejected or blocked sync row can no longer repaint the old time zone over an authoritative account snapshot.
- A newer change made on another device still wins cleanly instead of being overwritten by an older response.
Documented and bounded
- Privacy disclosures now explain the recipient email, delivery metadata, identity match, retention, and Resend processing used by the invitation flow.
- The full invitation security, recovery, and revocation contract is documented for future maintainers.
- This owner-only operation remains intentionally absent from the public REST API, OpenAPI document, MCP server, and OAuth scopes.