Delete your account and data
Version 7 · Last updated 5 September 2026
1. Overview
You can permanently delete your Relocat account and the data associated with it at any time. What happens next depends on which device you use, as Section 2 and Section 3 explain. Section 4 lists what is deleted, and Section 5 lists the exceptions and how long they last.
2. Delete from a device you are signed in on
Open Relocat, go to Settings, and tap Delete account near the bottom of the screen. After you confirm, deletion runs immediately: we begin deleting your account and its data at once, and it cannot be undone or cancelled.
3. Delete while restoring your account
If you are recovering access to your account on a new or reset device, and you choose to delete the account instead of finishing the restore, deletion is scheduled with a 7-day grace period instead of running immediately. This gives you a safety window in case someone other than you started the restore.
We email you a cancellation code. Paste it into the app within 7 days to cancel the deletion. Signing back in to your account during that window also cancels it automatically. If you do not cancel, your account and its data are permanently deleted at the end of the 7 days.
4. What is deleted
Deleting your account permanently removes:
- your account and all registered devices;
- all of your encrypted safes, documents and document versions, and the encrypted files held in cloud storage;
- all share grants and guest links you created;
- your synchronisation state and any browser sessions;
- any AI assistant (MCP) authorisations you have granted, together with their consent receipts and activity log (Section 5 explains the retention clock that applies only while your account exists);
- your Community Map profile, if you joined the map: display name, city and photo.
Your vault is end-to-end encrypted. Safes, documents and files can only be decrypted with keys held on your devices, and once deleted they cannot be recovered by you or by us. Your Community Map profile is different: display name, city and photo are stored in plain form so other members can see them, and they are deleted with your account, except as described in Section 5.
5. What is retained and for how long
After deletion we keep a limited number of records.
A photo held as evidence
If a photo you added to the Community Map is being held as evidence of a suspected serious offence, we keep the photo until the hold is closed, then delete it. We keep a record that the hold existed for three years after it closes: it holds the dates, the stated ground, the moderators’ notes and a digital fingerprint (a cryptographic hash) of the photo, but not the photo itself. Deleting your account removes the link between that record and your account, but the record is not anonymous: the fingerprint and the notes can still identify the photo. See the Privacy Policy, Section 3.11 (Community Map), for the full explanation and the legal basis.
Accounting records
Rows recording revenue, commission, payouts and bonuses connected to the optional PRO program are kept after deletion, with the reference to your account removed. They have no scheduled deletion date: we keep them as part of our permanent financial and accounting history, not as a record about you personally.
Crash reports you already sent
These are not linked to your account, so deleting your account does not remove them from our crash-reporting system. See the Privacy Policy for how long we keep a crash report.
Statutory records
Where the law requires us to keep a record, for example certain tax or accounting records, we keep it for as long as the law requires, then delete it.
Infrastructure request logs
Our servers’ request logs (IP address, path, timestamp) are not linked to your account. They are deleted on their own schedule regardless of whether you keep your account; see the Privacy Policy for how long.
AI assistant records
The signed consent receipts and the activity log for the AI assistant feature are deleted at once when you delete your account, together with everything else in Section 4. They do not survive deletion. While your account exists, they are kept for up to 13 months from creation, as the auditable record of the approvals you granted; they contain no vault content.
6. If you no longer have a device
If you have uninstalled Relocat or lost access to your only device, you can still request deletion. Email privacy@relocat.org from the email address registered to your account, so we can match your request to your account. We cannot verify your identity using your encryption keys, because we do not hold them; we match the email address instead.
This is a request an operator handles by hand. We do not have an automated intake system for it, so there is no separate acknowledgement email or ticket number. Because it is a manual process, it can take longer than deleting from a device you are signed in on. Once we act on it, we carry out the same deletion described in Section 4.
7. Version
Version 7 (September 2026): Describes both deletion paths for the first time. Deletion from a device you are signed in on is immediate; a 7-day grace period with an emailed cancellation code applies only when you delete while restoring your account on a new or reset device. Corrects the in-app menu location: there is no Settings → Account submenu, and Delete account is its own entry near the bottom of Settings. Corrects the cancellation mechanism: it is a code you paste into the app, not a link. Corrects the email route: it is a manual, operator-handled request, and there is no automated acknowledgement or ticket number. Adds three retention categories the previous version did not mention: accounting rows preserved with the account reference removed, crash reports already sent, and infrastructure request logs. Corrects the evidence-hold record: it is kept for three years, not without a fixed limit, and it is not fully unlinked from you, because it keeps a digital fingerprint of the photo and the moderators’ notes.