Deferred User Account Deletion with a 30-Day Grace Period

Users on Free and Paid tiers can now self-schedule account deletion directly from the Settings page or via the API. Once initiated, personal sessions are hidden immediately, active billing renewals are halted, and personal API keys are revoked. To protect against accidental loss or regret, deletion is deferred across a 30-day grace period during which users can cancel the deletion and fully restore their account with a single click.

How it works

Account deletion operates in two distinct phases: an immediate graceful transition followed by an asynchronous background purge.

Scheduling deletion

When you schedule account deletion from Settings > Danger Zone or call DELETE /api/user/account:

1. Personal session hiding: All personal sessions (sessions without an organization association) are immediately soft-deleted and marked ineligible for derived compute. They disappear from your dashboard, search index, and CLI summaries.
2. Key revocation: Personal API keys are revoked to prevent automated background capture or script traffic.
3. Billing management: Paid subscriptions are updated so that they do not renew at the end of the billing period.
4. Lifecycle state: Your account enters the pending_deletion state with a scheduled purge timestamp 30 days in the future. A confirmation email is dispatched with the exact purge date.

A persistent banner appears across the dashboard indicating the remaining grace period days and providing an immediate restoration action.

Self-service restoration

Any time during the 30-day window, you can cancel deletion either directly from the dashboard banner, in Settings, or via POST /api/user/account/restore.

Restoring an account:

• Reactivates your account profile to active status.
• Unhides all personal sessions, re-enables derived computation, and returns them to your dashboard and search indexes.
• Resumes regular subscription renewal if a paid tier subscription was active.
• Dispatches a restoration confirmation email.

Permanent background purging

Once the 30-day grace period expires, a nightly retention worker performs the permanent infrastructure cleanup:

• Raw session blobs and context archives are deleted from multi-region storage (US and EU).
• Vector embeddings and sparse index points are purged from the search index.
• Relational database records (sessions, records, datasets, API keys, user settings, feedback entries, billing accounts, and profile rows) are permanently deleted.
• The underlying authentication user is removed from identity storage, and any remaining Stripe subscriptions are cancelled.

Organization and enterprise boundaries

Organization accounts and team members operate under different retention constraints:

• Enterprise users: Team members belonging to active organizations cannot self-delete their accounts via this endpoint. Organization-scoped data, audit histories, and team sessions are owned by the organization and governed by team administrators.
• Personal vs. org sessions: Only personal sessions are hidden and purged during user deletion. Organization-owned sessions remain intact within their respective team workspaces.

Motivation and tradeoffs

Immediate, synchronous deletion in multi-tenant systems introduces real failure modes: cross-region storage sweeps and vector point deletions can take considerable time, risking API timeouts and partial deletion states if network calls fail mid-request. More importantly, accidental account deletions leave no recourse for recovery once storage blobs and encryption keys are destroyed.

By decoupling the user's intent from the irreversible destruction of data, the 30-day deferred lifecycle provides a safety buffer while ensuring the eventual purge is thorough, idempotent, and resilient against transient network failures.

Feedback and next steps

We are monitoring background purge reliability and tracking restore flows. If you have questions about data retention, enterprise data governance, or suggestions for custom grace period policies, please let us know via the in-app feedback dialog or reach out to support.