You need one to upload reports. Reading the statistics needs nothing.
Shown next to your reports. A handle is fine.
Stored encrypted at rest. Used for password reset and nothing else — no newsletter.
At least 12 characters, mixing at least two of: lowercase, uppercase, digits, symbols. Hashed with Argon2id.