Your data, private export and account erasure

Private archive of stored own inputs

Sign in and load your export jobs. Review the scope, give consent and confirm one request. After confirmed queue acceptance, preparation continues in the background even after leaving. Refresh status manually. For an uncertain outcome, check the original command first; explicitly retrying the same key never creates a second job.

Extract the ready TAR.GZ: manifest.json lists every section, column, exclusion and fingerprint. JSONL has one original object per line; CSV has one record per row and fixed section columns. Amounts remain exact strings. CSV prefixes formula-like text with an apostrophe and displays null as blank; JSONL preserves original values including null versus empty text. Data file and byte counts exclude the manifest itself.

All parts come from one coherent read when the job is processed, not necessarily from the button-click time. Passwords, tokens, MFA secrets, foreign messages and provider results are excluded. Your references grant no source rights. Purged original imports and deleted words are not reconstructed. The manifest discloses the separate CMS, external copies and other exclusions. This is not a restorable whole-application backup or complete handling of all personal-data portability obligations.

Only the current signed-in owner may download the archive; technical delivery expiry is 24 hours from the request. Every download rechecks account, session, job expiry and file fingerprints. After expiry, request a new current snapshot. This period neither erases source inputs nor defines general legal account retention. Incomplete preparation is not issued as a complete archive. Actual account erasure has its own review and separate steps described below.

An actual account erasure request

Below the actual export, review an actual erasure request. Download your own data if needed and retain the exact recovery JSON outside this page first. It contains only a random code and command identity; it reads progress after sign-out and cannot sign in or initiate another erasure. Handing the file to the browser does not establish that you saved it.

Confirm you retained the code, type DELETE ACCOUNT exactly and enter your current password. Confirm with the separate button. An account using multifactor verification or a staff role also requires recent verification in Account security. The password is cleared after sending and never retained for retries. Acceptance revokes all sessions, blocks new sign-ins and withdraws own public words and sharing links.

Ordinary own application data is then erased in the background. Other people’s replies are preserved; where they need their original context, empty structure remains without the original author or words. Restricted security and moderation records, the publishing system, external services and backups have their own review-required steps. Application data processed does not establish physical deletion of every copy or a legal retention period.

If a response is lost, do not send a replacement request. Check the original status with the retained code only. After leaving the page, paste recovery JSON in the separate recovery area, load it without sending, then explicitly check progress. This needs no sign-in and never sends erasure. A missing record does not prove that an in-flight write cannot commit. Cancelling the wait never revokes an already accepted request.

Remaining-copy review for administrators

An authorized administrator opens Review remaining account copies in Settings. Access requires an active administrator role, verified email, enabled and enrolled multifactor authentication and recent verification in Account security. Ordinary sign-in or knowing a request identifier grants no access.

After explicit verification, page through the queue and open a request’s exact inventory. It contains original internal references, not copied messages or the private recovery code. The original subject identifier remains personal data. The fingerprint identifies the recorded inventory; it does not establish that a copy in another system still exists or has been removed.

Open a review for one original reference. Inspect the current record and paginated history, then prepare either a provisional hold for further review or a required follow-up action. Enter your own reason and an opaque reference to related evidence; do not paste case contents, passwords or keys. Review the whole draft and save with a separate confirmation. A newer decision by another administrator requires a fresh review.

The receipt preserves the original decision while the current review may change later. If a response is lost, check the original command first. Nothing retries automatically; an explicit retry uses exactly the same key and content. A missing record does not establish cancellation of an in-flight write. Recovery after a new sign-in by the same administrator requires fresh verification; the pending command lives only in this page’s memory.

A review record alone neither erases nor releases a copy and changes no account-erasure completion state. The optional next-review time is a recorded field only: it schedules nothing, ends no hold and establishes no legal deadline. An unrecorded inventory is unavailable, not proof of zero copies. Sensitive details are hidden when the short verification expires or the page is hidden; load them again through explicit verification.

After application erasure, explicitly verify allowed fields for one supported exact audit reference. The preview shows the event type, whole-record fingerprint and field names, never original personal values. A staff-binding change supports the original operator’s reason and identifier; a moderation or correction decision supports only the original reason. Unknown types and inconsistent associations are unavailable for this action. Reading this preview records a minimal access audit without copying original words.

Actual removal of selected fields requires a current Action required review. Choose fields, enter an opaque approval reference and inspect the exact draft. Separate confirmation is bound to the original source fingerprint and review revision; a hold blocks a new action. The receipt preserves removed field names, before/after fingerprints, the review revision and time, never removed text. History and original receipts support recovery after a lost response without repeating the change. Other event fields, case records, CMS, external copies and backups are not resolved by this step.

What you can download today

In Settings, open My data and privacy. Download the six current browser preferences directly: language, theme, density, currency, time zone and sign-in destination. The file contains no sign-in, password, token, profile or portfolio. It is not a complete account backup and is not imported automatically.

The overview leads to exports of a selected own portfolio and the investment journal’s current own words. The destination checks sign-in and current access. Profile, signed-in sessions and the Assistant library have separate readers; linking to them does not promise a complete export. Original import files may already have been removed after confirmation under their stated policy.

Separate export demonstration

Open the demo explicitly. It uses only eleven fictional records across six categories and copies nothing from your account. Choose categories and inspect their records before downloading JSON or CSV. Amounts remain exact strings. CSV uses one row per original field, standard quoting and a protective apostrophe before text a spreadsheet could interpret as a formula. JSON retains the original text.

Erasure review and demo limits

Erasure review covers the entire fictional account regardless of the earlier export selection. Inspect the effect on sign-ins, sharing and own text, give consent and enter exactly DELETE DEMO. The result empties only the current demo export. Changing the selection or resetting invalidates an old review.

The complete original fictional fixture remains separately downloadable, and reset restarts the demo. This demonstrates the proposed interaction, not physical erasure. Actual export and erasure requests use only the separate actual sections above; the demo neither initiates nor verifies them. Exceptions and copies have their own actual statuses. No demo button erases an actual account.