Delete your account

Where the control is

On your Profile page, inside the account panel. There is one delete control and it is that one - the app deliberately does not have a second of its own, because two delete buttons doing different things is how an account ends up half-removed.

What is removed

Everything belonging to your account, in a single operation:

• Your jobs, including drafts, finished work and anything soft-deleted.
• Your capacity variables and the values on every job.
• Your time off, including any away label you wrote.
• Your job activity history.
• Your recurring job rules.
• Your job templates.
• Your published snapshots - so your Beacon, your badge and your share card all stop resolving.
• Your waitlist, including every entry, note and tag on it.
• Your testimonials, which carry other people’s words.
• Your settings, your audit log and your feedback.
• Your email delivery log - which is where your own address, and every waitlist address you ever mailed, would otherwise have survived.
• Your account row itself, and with it your username.

The deletion itself leaves no record in the database. No audit entry is written saying an account was erased. What survives is an operational log line naming when it happened and by which mechanism, carrying no identifier of any kind.

What is not removed

Two things, and both are deliberate rather than oversights.

1. The deletion confirmation’s own log row. You are sent one email confirming the account is gone, and that send writes its own delivery record - after everything else has already been destroyed, so it cannot be removed with the rest. That row carries no link to your account and the recipient is stored masked, in the form a***@example.com. What survives is the domain of your email address; the address itself does not.

2. Client-side error reports. If your browser reported a fault to us while you were using the app, that report holds no account identifier, so erasure has nothing to match it against. The report can contain the URL that failed, and a Beacon URL contains a username. These reports are deleted on their own schedule, 30 days after they were recorded.

Both are recorded as known limits rather than described as complete removal. Whether that satisfies a particular legal obligation is a question for your own advice; this page states what the code does.

How long it takes

Normally seconds. In the worst case, about 24 hours.

Deleting your identity and erasing your data are two steps. The first happens immediately; the second is triggered by a message that follows it. If that message is lost, a nightly reconciliation catches it - and that runs once a day, which is where the 24-hour bound comes from.

Before you delete

• Take copies first, and know what you can copy. None of this is recoverable afterwards - unlike deleting a job, this is not a soft delete. There is no single “export everything” button: it was removed deliberately, because a one-click download of an entire account is a large amount of somebody’s data behind one click. What you can export is your waitlist, from the waitlist page, and your load trend, from Insights. Anything else you want to keep, keep by hand.
• Your waitlist goes with it. Every address on it, and the record of who consented and when.
• Your username is released. Any link, badge or embed pointing at your Beacon stops resolving - a badge on somebody else’s site will render the neutral Unavailable pill rather than continuing to publish an old status.