Try it free

Sharing a nonprofit Gmail account between volunteers

A shared password, sign-in prompts on the founder's phone, a board that changes: what breaks in a shared nonprofit Gmail account and how to secure it.

Quentin, founder

Published on 28 September 2026 · Updated on 9 October 2026 · 14 min read

In this article (8)
  1. How most volunteer groups end up sharing one Gmail password
  2. Why Google asks “Is it you?” on one volunteer’s phone
  3. Who really owns the account: the recovery phone and email
  4. When the board changes
  5. Sharing one Gmail account between several volunteers: your options
  6. A checklist to secure the account tonight
  7. When several volunteers answer every week
  8. Frequently asked questions

As far as Google is concerned, a free Gmail account belongs to one person, even when it is called ourgroup@gmail.com. When a volunteer signs in from a new device, Google may ask for the sign-in to be confirmed on a phone that is already signed in to the account, which is often the phone of whoever created it. So sharing the password works until the day that phone is gone. Gmail delegation, up to 10 people on a free account, and half an hour of settings tonight get most of this under way. Not everything is in place the same evening, though: delegation can take up to 24 hours, and for 7 days after the recovery details change, Google may still send codes to the old details.

How most volunteer groups end up sharing one Gmail password

The account was created four years ago by the chair, on a Sunday evening, on her phone. The password went round by text message: to the treasurer, to the secretary, then to the volunteer who handles sign-ups. Everyone uses it, from their laptop, their phone, sometimes the club’s computer.

Then the small snags start. A parent gets two different answers to the same question, because two volunteers opened the message on the same evening. The treasurer cannot sign in while travelling because Google is waiting for a confirmation he never sees. And at the annual meeting a new board is elected: the chair steps down, taking with her the phone everything depends on.

None of this is anyone’s fault. It is what happens when a tool designed for one person is used by a group that changes every year.

Why Google asks “Is it you?” on one volunteer’s phone

Google calls these Google prompts: a notification on a phone signed in to the account, asking you to confirm a sign-in attempt and showing the device, location and time. They arrive on Android phones signed in to the account, and on iPhones where the Gmail, Google, Google Photos or YouTube app is signed in to it.

The part that catches everyone out: this is not 2-Step Verification. 2-Step Verification is a setting you turn on yourself. Prompts can appear without anything being turned on. Google’s help page says so in one sentence: “Even if you haven’t turned either of these settings on, Google might also ask you to tap a notification to help confirm it’s you signing in.” And when a sign-in looks different, for example from a new location, Google may ask for extra steps, such as matching a number on the computer screen with one on the phone.

For a nonprofit account, that means three concrete things:

  • whoever holds the signed-in phone decides, without meaning to, whether the others get in;
  • a volunteer signing in from a new laptop can be stuck for a whole evening if that phone does not answer;
  • if someone cannot answer the sign-in challenge, the account “might be temporarily locked for everyone”. Google says it plainly in its documentation for administrators: “Google Accounts are intended for use by only one person.”

It does not happen every time. Plenty of groups share a password for years without trouble. But the day it goes wrong tends to be a Saturday morning, just before an event.

Who really owns the account: the recovery phone and email

The password gets you into the account. The recovery information decides who can take it back. That is the phone number and email address Google uses when you forget the password, when someone else is using the account, or when you are locked out. In a volunteer group, they were almost always entered when the account was created, so they belong to the person who created it.

Google recommends “a mobile phone that gets text messages, belongs only to you, and that you use regularly and keep with you”, and a recovery email that is not the one you sign in with. That advice is written for an individual. For a group there is no perfect answer: the number has to be somebody’s. The best you can do is choose deliberately, and write it down.

Two things help you stop depending on one person:

  • A recovery email the group can reach, for example the personal address of a second board member, or a role address if you have one. Never the nonprofit’s own Gmail address.
  • A recovery contact, someone you trust who can help you get back in if you forget the password. They do not receive your security alerts. Once they accept, you have to wait 7 days before you can call on them, and this option is not available in every region or for every account.

Google also notes that you cannot add recovery information once you have lost access to the account. Do it while everything still works.

When the board changes

Handing over a Gmail account takes a handful of steps, as long as they happen before someone leaves, not after. The rest of the handover (filings, bank, payment platforms) is in our board change checklist.

  1. The person leaving makes the changes themselves, from their usual phone. Google says that if your sign-in habits change you may not be able to edit recovery information, and suggests trying again from a device or place you usually sign in from. The new board, on a new device, is the worst placed to do it.
  2. Replace the recovery phone and email. For 7 days after the change, Google may still send codes to the old details: do not plan the handover for the day before someone leaves.
  3. Sign out the departing person’s devices, from Security & sign-in, under Your devices. As long as their phone stays signed in, it can keep receiving prompts.
  4. Remove their delegate access if they had any, and change the password. In Gmail on a computer: Settings > See all settings > Accounts and Import > Grant access to your account > Delete, next to their account.

For the other half of a handover, keeping the email history and who was dealing with what, see our article on volunteer email handovers.

One last point for groups that go quiet for a while: Google reserves the right to delete an account that has been inactive for at least two years. Reading or sending an email counts as activity, so use the account now and then, even during a dormant spell.

Sharing one Gmail account between several volunteers: your options

Keep sharing the password. It is free and everyone knows how. But the prompts still land on one phone, every departure means a new password for everyone, and nobody knows who answered what. France’s data protection authority, the CNIL, recommends banning accounts shared between several users and, where one cannot be avoided, changing the password as soon as someone no longer needs access. It is the weakest option, even if it is the most common. What a shared password really costs is set out in sharing a mailbox without sharing the password.

Gmail delegation, free on a free account. The owner gives other Google accounts the right to read, send and delete messages, without handing over the password. According to Google’s help pages, as checked in September 2026:

  • a personal @gmail.com account can have up to 10 delegates;
  • each delegate needs their own Google account;
  • you have to verify your identity to add a delegate, and you cannot do it from the Gmail app: plan for a computer and the owner’s phone;
  • the invitation expires after a week, and access can take up to 24 hours to start working;
  • the delegate’s own address appears when they send from the account, so a volunteer’s personal address becomes visible to your members;
  • a delegate cannot reach the Google Account settings or change the password;
  • access from the Gmail mobile app is still rolling out, personal accounts included, so it may not be available to you yet.

One thing people forget: ourgroup@gmail.com is not just a mailbox. It is a whole Google account, which often also holds the group’s Drive, its calendar and its contacts. Sharing the password opens all of that at once. Gmail delegation gives access to the email: reading, sending, deleting. For documents, share the Drive folders one by one with each volunteer’s own Google account.

It is the best free way out of a shared password. It still does not say who is dealing with which message. The details are in our article on the limits of Gmail delegation.

Automatic forwarding. Gmail can forward all new messages, except spam, to another address once that address confirms a verification link. For several recipients you need one filter per address. It is a simple way to be notified, but each volunteer then replies from their own mailbox: the nonprofit’s address is no longer the sender, and the history scatters.

Moving to Google Workspace for Nonprofits. A nonprofit can apply for Google Workspace for Nonprofits, at $0 per user per month (0 € on Google’s French page, as observed in September 2026), once it meets its country’s requirements and is verified by Goodstack, Google’s validation partner. In France, Google requires a nonprofit “registered in French Legal Publication (Journal Officiel des Associations or other)”. Each person then gets an address on your own domain. It is the cleanest answer in the long run. But it is a new address, not a conversion of ourgroup@gmail.com: you need a domain, you need to tell your members, and you need a period where the old address is still checked. The Drive files stay on the old account, so they have to be moved too. Eligibility and steps are in our Google Workspace for Nonprofits guide.

A shared inbox tool on top of Gmail. You keep the address, everyone gets their own access, and the tool adds a way to split the work. We compare the approaches in sharing a mailbox without sharing the password, and the free options in free shared mailbox options.

A checklist to secure the account tonight

Half an hour, with the person whose phone is signed in to the account:

  1. List who knows the password today. On paper, including former members. The list is usually longer than you think.
  2. Open Security & sign-in in the Google Account and look at the recovery phone and email. Write down whose they are.
  3. Put the recovery email on an address the group can reach, for example a second board member’s. For 7 days after the change, Google may still send codes to the old details: do not do this the day before someone leaves.
  4. Add a recovery contact from the board, if the option is offered to you.
  5. Review the list of signed-in devices and sign out the ones that no longer belong there: the club laptop that was sold, the former treasurer’s phone.
  6. Change the password one last time, then add each volunteer as a delegate with their own Google account.
  7. Share the group’s Drive folders with each volunteer’s own account, rather than through the password.
  8. Write down in the group’s records who holds what: recovery phone, recovery email, list of delegates.
  9. Put the account on the agenda of the next board handover, next to the bank account.

To let volunteers know about the change, a short message does the job:

Example email

Hi everyone,

From Saturday we are no longer sharing the password for ourgroup@gmail.com. You will each get an invitation from Google to access the mailbox with your own account. Please accept it within the week, as it expires after that.

One thing to know: when you reply from the group’s mailbox, your personal address also appears on the message. If that is a problem for you, tell me before Saturday.

Thanks, and please stop using the old password: it will have changed.

When several volunteers answer every week

If the mailbox gets three messages a month, delegation is enough. Once two or three volunteers answer it every week, the real question becomes: who is dealing with this one?

That is what Trupeo does. You connect ourgroup@gmail.com once, and each volunteer signs in with their own account. Each message can be assigned to someone and carries a status: to assign, to handle, done. You add internal notes, mention a colleague, and see when someone is already drafting a reply. If the group stops using Trupeo, the address keeps working at Google, as before. The data is hosted in France, and Google approved Trupeo’s CASA security assessment on 19 September 2026.

Pricing is per connected mailbox, per month, excluding VAT, with every feature included. For a verified association (a registered charity or voluntary association) it is 5 € for two people and 10 € from three people, instead of 10 € and 20 €. What it does not fix: it is one more tool, and someone still has to connect the account once, with the owner’s phone within reach. See our page for non-profits and our pricing.

Frequently asked questions

Can a nonprofit use a free Gmail account?

Yes, nothing prevents it and most small groups do. Just know that Google treats the account as one person’s: its recovery information and the phones that receive sign-in prompts belong to someone. Check them and write them down in the group’s records.

How can several volunteers use one Gmail account without sharing the password?

With Gmail delegation. The owner adds each volunteer as a delegate from a computer, in the Gmail settings. Each delegate needs their own Google account, and a personal @gmail.com account can have up to 10 delegates according to Google’s help pages as checked in September 2026.

Why does Google send a prompt to one volunteer’s phone when someone else signs in?

Because that phone is signed in to the account, and Google may ask for a tap on a notification to confirm a sign-in even when nobody has turned on 2-Step Verification. It is more likely when the sign-in comes from a new device or an unusual location.

How many people can access a shared Gmail account?

Through delegation, up to 10 people on a free @gmail.com account (the full limits are in our article on Gmail delegation). With a shared password there is no stated limit, but Google says an account is meant for one person and can be temporarily locked for everyone.

What should we do with the Gmail account when a board member leaves?

Before they leave, they replace the recovery phone and email from their usual device and sign out of their devices, and you change the password. Remove their delegate access too, if they had any. For 7 days after the change, Google may still send codes to their old details.

Do recipients see which volunteer replied?

With a shared password, no: everything goes out from the nonprofit’s address, under the same name, whoever wrote it. With delegation, yes: Google says the delegate’s email address appears when they send from the account.

Sources:

Read next

Advice is good. Trupeo is simpler.

Try Trupeo on the mailbox you already share.

Try free for 30 days
  • No credit card
  • You keep your address

Cookie preferences

Trupeo uses cookies for essential functions and, with your consent, to measure audience and improve the product. You can change your choice at any time from this window. Your choice applies to trupeo.com and app.trupeo.com.

Read our full privacy policy