Delete your account
Delete your account yourself in Settings, in two steps. What is erased, what cannot be reached, and how to delete only some data instead.
You can delete your account yourself, from the app, in two steps. If you cannot sign in, you can still ask us to do it.
The website carries the same instructions on two pages: Delete your account and Delete your data.
There is no grace period and no way to reactivate the account. Because your messages are encrypted with keys we do not have, we cannot give you an export of them first — download anything you want to keep while you are still signed in, and tell your contacts about a new address beforehand. There is no forwarding.
Delete it yourself
- Open Settings. Click your name at the bottom-left of the app, then Settings.
- Go to Security and privacy, then Privacy and data — the last row.
- Press Delete my account. The first screen says what deletion reaches, and offers Pause my account instead if you only want everything to stop for a while.
- Confirm on the second screen by typing your full email address exactly as it is, then press Delete my account.
A paused account cannot be deleted. Switch it back on first, from the same screen, then delete it. That second decision is deliberate: pausing is the reversible choice, and we do not turn it into the irreversible one in one click.
If you cannot sign in
- Write to us at the address on the contact page, with the subject Delete my account and your full Private.Ki address.
- Show that the account is yours. Write from any address and — if you set a recovery email address on the account — send it from that address.
- Confirm in the same message that you understand everything stored under the account will be deleted and cannot be recovered.
- We check and delete. Once we have confirmed the account belongs to you, we delete it and reply to tell you it is done, within the one-month period data-protection law sets.
We cannot verify you by password or passphrase: we never see either, and we cannot reset a passphrase. If you have no way to prove the account is yours, we cannot delete it on your word alone — that is what protects every account from being deleted by somebody else.
What is deleted
The account record and everything stored under it leaves our active systems:
- The account itself — username, display name, sign-in record (OPAQUE), two-step verification settings and security keys, and the hashes of your recovery email address and recovery key.
- Your encryption keys as stored with the account — the public key and the encrypted private key.
- All messages in every folder — received, sent, drafts and Trash — and all secure notes, together with their threads.
- All chats, including group chats you are in, your reactions, and the message tombstones and self-destruct settings that belong to them.
- Encrypted attachments stored under your account. The files are removed from object storage by a background job right after the account goes; a daily check removes anything that job missed.
- Signatures, recipient history, imported public keys of your contacts, trusted image sources and chat invitations you issued.
- Device pairings and sessions, and the push-notification tokens of your phones.
- Anti-abuse records tied to the account, such as sending-limit strikes.
Every device is signed out; existing sessions and refresh tokens stop working. Mail sent to the deleted address is no longer delivered.
What is kept, and for how long
| What | For how long |
|---|---|
| Copies held by other people. A message you sent sits in the recipient's mailbox, encrypted to their key, until they delete it. The same applies to chat messages and to your address in another user's recipient history. | Their decision, not ours. Mail you sent to other providers has left our systems and cannot be recalled. |
| Backups. The database is backed up nightly into encrypted archives no server can read. | Off-site copies are removed automatically after 90 days at the latest. Backups restore the service after a failure; they are not used to bring back individual accounts. |
| Rate-limiting counters, kept per keyed hash of the IP address for abuse prevention and not linked to the account. | Within an hour (one daily counter for the no-sign-up entry keeps it up to 24 hours). |
| Server logs. The mail server's delivery log records the addresses and times of messages exchanged with other providers; it is not linked to the account. | Rotated as the server runs. |
| A record that a deletion took place — our staff console writes an audit entry holding the date and the account's internal identifier, not your address or name. | Audit entries are pruned after one year. |
| An empty record reserving the address, so that the username cannot be registered again by anyone, including you. It holds the address and nothing else — no key, no messages, no sign-in record. | Kept. |
| Your own support message, which stays in our support mailbox like any other correspondence. | As long as we keep support mail. |
Delete only some data instead
You do not have to delete the account to remove data. While signed in you can delete individual emails and threads and then empty Trash, delete chats or single chat messages, unsend a chat message within the first hour, delete secure notes, remove your recovery email address, remove security keys and sign out other devices. Each of these removes that data from our servers while the account stays.
The website's Delete your data page has step-by-step instructions for each kind. See also Delete and restore email.
Your content is encrypted with keys only you hold, so we cannot find or pick out a particular message on your behalf. Anything message-shaped has to be done from the app.
What our server sees
Cannot see
- Your mail, chats or attachments, before or after — we delete ciphertext we could never read
- Your passphrase or password, so a deleted account cannot be "restored" for you
Can see
- That an account existed, and the date and internal identifier of its deletion, for one year
- Your support message, like any other mail to support
Common questions
Where is the delete button?
In Settings → Security and privacy → Privacy and data, under Your account. The same screen also has Pause my account if you want everything to stop without losing anything.
Will my account be deleted if I stop using it?
No. Private.Ki does not delete accounts for inactivity — see Inactive accounts.
Can I get my messages out first?
Not from us. Download what you want to keep while you are still signed in and unlocked; after deletion nothing readable exists, and we never had the keys.
Can I have the username back later?
No. The address stays reserved after deletion so that nobody can take it over and receive mail meant for you — and that includes you. Signing up again means choosing a new address.
Can I stop everything without deleting?
Yes — Pause my account, on the same screen. Nothing goes out and your public key stops being published, but mail addressed to you still arrives, nothing is deleted, and you can switch it back on whenever you like.
I want to exercise my GDPR rights.
Most of them are controls on that same screen. See GDPR data request for which control answers which right, and GDPR for the background.