Exporting or deleting your data

You can take everything we hold about you, and you can have it erased. Both are self-service, both are complete rather than partial, and this article says exactly what each one does — including the thirty-day window between asking for deletion and the data being gone.

Exporting your data

A subject-access export, from your account’s privacy settings. It returns everything linked to you across the whole database — not a curated summary.

That distinction matters. The export is driven by a manifest of every user-linked table rather than by a hand-written list, so anything the system stores about you appears in it automatically. An earlier version listed eight tables by hand while the schema had fifty-one, which meant it quietly returned about an eighth of a person’s data.

Two things are deliberately excluded: secrets. Live password-reset and email-verification tokens are erasable but never returned, and anything token-shaped is stripped. Exporting a working reset token to an address that might be compromised would be handing over the account rather than the data.

Deleting your account

1. Answer three short questions — Why you are leaving, what would have made you stay, and whether you might come back. Each has an “I’d rather not say” answer, and there is room for an optional comment.
2. Confirm with your password — Deletion is destructive, so it re-authenticates. A stolen session cannot delete an account.
3. Your account closes immediately — You are signed out the moment you confirm, and a paid plan stops at the end of the period you have paid for. We email you to confirm, with a link to undo it.
4. The data is held for 30 days — So a mistaken deletion is recoverable — you can reactivate the account yourself at any point. We remind you a week before and the day before.
5. After 30 days it is gone — Hard-deleted across every table in the same manifest the export uses. Only an anonymous summary remains — see below.

Why export and erasure agree

Both read the same manifest. A table added to the system appears in the export and in the erasure at the same time, which removes the failure mode where a new feature quietly stores data that neither operation knows about.

It is the reason we can say "everything" and mean it.

Children’s accounts

A guardian-managed child account is a real account with its own data. As the guardian on record you can delete it, and the same rules apply: immediate closure, thirty days, then permanent erasure.

Deleting your own parent account does not automatically delete a child’s. If that is what you want, do the child accounts first.

Changing your mind

Within thirty days you can bring the account back yourself, with everything as it was: sign in with your email and password (or Google or Apple), or use the Reactivate my account link in any of our emails about the deletion. Forgotten the password? Use Forgot password and we will email you a reactivation link instead. A paid plan resumes too, unless its paid period has already ended.

After thirty days there is genuinely nothing left to restore, and a new account starts from zero.

Written and maintained by the Mandarin Temple Editorial Team.