← Help

Getting started

Account basics — what Trevul is, how to sign up, how to keep your login safe.

What is Trevul?

Trevul is an online marketplace for plants, supplies, and plant-adjacent goods. Independent US growers list items as auctions or Buy It Now; buyers bid or purchase, pay through Stripe or PayPal, and the seller ships directly. Trevul takes a small percentage on each sale and never handles the inventory.

For the legal frame, see our Terms of Service.

How do I sign up?

Pick a username (3–30 characters, letters / digits / underscore / dash — no @ or dot so it can't look like an email), a display name, a strong password, and accept the terms. We'll send a verification code to your email; enter the code to finish signup. The code is good for 15 minutes and you can resend it once a minute if it doesn't arrive.

Why do I need to verify my email?

Verifying proves the inbox is yours. You can browse listings without verifying, but bidding, messaging sellers, leaving reviews, and saving payment methods all require verification. It's a one-shot step — once done it sticks until you change your email.

How do I turn on two-factor login?

Visit Account → Two-factor and scan the QR code with an authenticator app (1Password, Google Authenticator, Authy, Bitwarden — anything TOTP-compatible). Once enrolled, every login asks for a 6-digit code from your app.

We also generate 8 single-use backup codes at enrollment. Print them or stash them in your password manager — they're your recovery path if you lose your phone. If you don't enroll TOTP, we fall back to emailing you a 6-digit code on each login.

Remember-me on 2FA — how does that work?

Successful 2FA stamps a signed cookie on your device that lasts 24 hours. Inside that window, future logins from the same browser skip the code prompt. Signing out, clearing cookies, or logging in from a different device starts a fresh challenge.

I got locked out trying to log in.

After 5 wrong attempts we lock the username + IP combination for 30 minutes. This is independent for each IP, so a typo binge from your laptop doesn't lock you out from your phone. If you're locked out, use the "Forgot password" link or wait it out — once the cooldown passes, the slate is clean. Wrong 2FA codes count toward the same bucket as wrong passwords.

What's that little 🌱 next to my name?

Your plant-tier level. Six tiers from 🌱 Seedling to 🏆 Curator, climbed by completing transactions and earning good reviews over time. The chip is public — buyers see it on your listings. See the Levels & points page for the full ladder.

Need a hand? Email support@trevul.com.