Data deletion
Removing a user's data when they ask or when it is no longer needed, in a way that is final, logged and safe from accidents.
Updated October 2026 · with examples from our own builds
What does data deletion mean in practice?
Both app stores require apps that let people create accounts to let them delete them too, and data protection laws give people rights over their data. Deletion has to reach every place the data lives, from main records and uploaded files to search indexes, within a stated time.
The hard parts are at the edges. What if the user has an unpaid balance or an open refund? What if a law requires some records to be kept? How do audit logs and support tickets that mention the user stay readable? A grace period and clear refusals answer most of these.
Deletion text in the app must also match the law that actually applies to the product, which is easy to get wrong when a codebase moves between countries.
Data deletion at a glance
- Required by
- Both app stores, for apps with accounts
- Needs rules for
- Grace periods, legal holds and money still owed
- Keep
- A tombstone so logs still make sense
Where has data deletion come up in our builds?
After a 7-day grace window the user's encryption key record is destroyed, and 30 days later their records are hard-deleted while a tombstone keeps audit references intact. Both steps refuse under a legal hold or while a paid subscription has no refund decision. The per-user encryption the first step acts on isn't in place yet, so crypto-shred is not signed off.
The superadmin console carries an account-deletion audit with a 60-day grace period, and our review response flagged deletion text that cited Indian tax law and INR retention periods in a UAE product.
Account erasure runs as one of the phone backend's daily sweeps.
Common questions about data deletion
Do I have to let users delete their account from inside the app?
If they can create an account in the app, both Apple and Google expect a way to start deletion from inside it as well. Plan the flow, the grace period and what happens to their payments before you submit.
Should account deletion happen immediately?
Usually after a short grace period, so a mistaken tap can be undone, and never while money questions are open. Temphera waits seven days and refuses while a paid subscription has no refund decision recorded.
Related terms
Sources
Planning a product and not sure where data deletion fits? Ask us, or browse all 116 terms in the glossary.