Exporting or deleting your data

You can take everything we hold about you, and you can have it erased. Both are self-service, both are complete rather than partial, and this article says exactly what each one does — including the thirty-day window between asking for deletion and the data being gone.

Exporting your data

A subject-access export, from your account’s privacy settings. It returns everything linked to you across the whole database — not a curated summary.

That distinction matters. The export is driven by a manifest of every user-linked table rather than by a hand-written list, so anything the system stores about you appears in it automatically. An earlier version listed eight tables by hand while the schema had fifty-one, which meant it quietly returned about an eighth of a person’s data.

Two things are deliberately excluded: secrets. Live password-reset and email-verification tokens are erasable but never returned, and anything token-shaped is stripped. Exporting a working reset token to an address that might be compromised would be handing over the account rather than the data.

Deleting your account

1. Confirm with your password — Deletion is destructive, so it re-authenticates. A stolen session cannot delete an account.
2. Sign-in stops immediately — The account is closed the moment you confirm. There is no grace period during which someone could still get in.
3. The data is held for 30 days — Then a background job erases it permanently. The window exists so a mistaken or coerced deletion is recoverable.
4. After 30 days it is gone — Hard-deleted across every table in the same manifest the export uses. Not archived, not anonymised — removed.

Why export and erasure agree

Both read the same manifest. A table added to the system appears in the export and in the erasure at the same time, which removes the failure mode where a new feature quietly stores data that neither operation knows about.

It is the reason we can say "everything" and mean it.

Children’s accounts

A guardian-managed child account is a real account with its own data. As the guardian on record you can delete it, and the same rules apply: immediate closure, thirty days, then permanent erasure.

Deleting your own parent account does not automatically delete a child’s. If that is what you want, do the child accounts first.

Changing your mind

Within thirty days, get in touch — the data still exists and the account can be restored. After thirty days there is genuinely nothing left to restore, and a new account starts from zero.