Delete your account

Account deletion is available from your account settings. It is a terminal action — read this first.

What is erased

Your account record is scrubbed in place: email addresses, the identity-provider anchor, your handle, and your enrolled devices are cleared, and the lookup pointers that find you by identity provider or by handle are deleted along with your device bindings. Your sessions are revoked. What remains is a minimal tombstone with no personal data, so that anything still referencing the account gets a clean typed answer rather than a broken lookup or a server error.

Afterwards, every check that asks whether an account is active treats yours as not active, and discovery by email skips it entirely.

It cannot half-happen

The deletion runs through the same journaled account-status transition as every other status change, with its crash recovery. An interrupted deletion resumes to the same outcome rather than leaving an account partly scrubbed — and the erase-or-retain decision is recorded on the transition itself, so recovery makes the same decision the original attempt made.

What is deliberately kept

• Audit chain entries. The audit chain is cryptographically immutable — removing an entry would break the property that makes it worth having. Historical entries are retained, and the privacy policy discloses this.

• Your handle. It is retired rather than freed for reuse, so a later account cannot pick it up and appear to be you in old collaboration history.

Replicas

Erasure propagates to already-synced replicas on a best-effort basis: each applies the tombstone as it syncs. A replica that is offline forever cannot be reached, and we will not claim otherwise.

Legal holds

An organization under a retention obligation can turn erasure off for its members. Where a hold applies, deletion deactivates the account without scrubbing it — closed and sessions revoked, but the record kept for compliance.

Two layers compose, and both default to erasing. The operator of the deployment can disable erasure for the whole service; an organization owner can set a hold for that organization alone. Because an account can belong to several organizations, the most restrictive policy wins: a hold in any one of your organizations retains the account. And if the retention policy cannot be read at all, the account is retained rather than erased — under uncertainty the default is to keep the record, not to destroy it.

What deletion does not do

• It does not close your organizations, or delete repositories other people can still read.

• It does not hand your roles to anyone. If you are the only Owner of an organization, promote someone else first — an organization whose last Owner deletes their account has nobody left who can manage it, and no in-product way to appoint one.

• It does not cancel a plan for you — cancel first if you are the payer.

• It does not recover anything for you afterwards. There is no undo.

Before you delete

Export first, and confirm your key backups work.

Data requests

For a data access or deletion request outside this flow, write to privacy@tovio.dev.