Deleting your account and your data

If you cannot sign in, write to [TODO: contact email pending] from the email address on the account and ask for deletion. We check that the request comes from the account holder before we act, which is why the address matters.

Every session is revoked and you are signed out on every device. Push tokens are revoked, plan entitlements are switched off, and the account is marked deleted and can no longer be used to sign in.

A scheduled job hard-deletes the account, and the database cascade takes every journal profile and every entry with it. That step is irreversible: after it there is nothing left to restore.

The window exists so that an accidental deletion can still be undone by support. Its length is a retention decision rather than a technical one — 30 days today — and some jurisdictions require certain data to be kept longer. That is one of the points under legal review.

Audit-log entries remain, with no health data in them and with the acting user anonymised. They record that an action happened, not what your journal said. A security log that any request can erase would not be a security log, and keeping it in this shape — erase the person, keep the ledger — is what data-protection law expects.

Deleting the account on the server does not wipe the copy on your device. Delete individual entries, photos or whole profiles in the app, or remove the app: uninstalling deletes its sandbox, which is where the encrypted entries and the card photos live.

A profile you never synced was only ever on the device, so removing the app is the whole of its deletion.

You do not have to delete the account to delete data. Individual entries, individual photos and whole journal profiles can be deleted inside the app, and switching cloud sync off for a profile stops anything further being sent to us.