Delete your account
There is no delete button in Settings — you ask us, prove the account is yours, and we delete it. What is erased, and how to delete only some data.
Account deletion is done on request. The app has no delete button in Settings yet; you ask us, we confirm the account is yours, and we delete it. You do not need to be able to sign in to make the request.
The website carries the same instructions on two pages, and they are the reference version: Delete your account and Delete your data.
There is no grace period and no way to reactivate the account. Because your messages are encrypted with keys we do not have, we cannot give you an export of them first — download anything you want to keep while you are still signed in, and tell your contacts about a new address beforehand. There is no forwarding, and the address is not reserved for you.
How to request deletion
- Write to us at the address on the contact page, with the subject Delete my account and your full Private.Ki address.
- Show that the account is yours. The simplest proof is to send the request from the Private.Ki address you want deleted, from a device that is signed in. If you cannot sign in, write from any address and — if you set a recovery email address on the account — send it from that address.
- Confirm in the same message that you understand everything stored under the account will be deleted and cannot be recovered.
- We check and delete. Once we have confirmed the account belongs to you, we delete it and reply to tell you it is done. We act as soon as the account is confirmed as yours, and answer within the one-month period data-protection law sets.
We cannot verify you by password or passphrase: we never see either, and we cannot reset a passphrase. If you have no way to prove the account is yours, we cannot delete it on your word alone — that is what protects every account from being deleted by somebody else.
What is deleted
The account record and everything stored under it leaves our active systems:
- The account itself — username, display name, sign-in record (OPAQUE), two-step verification settings and security keys, and the hashes of your recovery email address and recovery key.
- Your encryption keys as stored with the account — the public key and the encrypted private key.
- All messages in every folder — received, sent, drafts and Trash — and all secure notes, together with their threads.
- All chats, including group chats you are in, your reactions, and the message tombstones and self-destruct settings that belong to them.
- Encrypted attachments stored under your account. The files are removed from object storage by a background job right after the account goes; a daily check removes anything that job missed.
- Signatures, recipient history, imported public keys of your contacts, trusted image sources and chat invitations you issued.
- Device pairings and sessions, and the push-notification tokens of your phones.
- Anti-abuse records tied to the account, such as sending-limit strikes.
Every device is signed out; existing sessions and refresh tokens stop working. Mail sent to the deleted address is no longer delivered.
What is kept, and for how long
| What | For how long |
|---|---|
| Copies held by other people. A message you sent sits in the recipient's mailbox, encrypted to their key, until they delete it. The same applies to chat messages and to your address in another user's recipient history. | Their decision, not ours. Mail you sent to other providers has left our systems and cannot be recalled. |
| Backups. The database is backed up nightly into encrypted archives no server can read. | Off-site copies are removed automatically after 90 days at the latest. Backups restore the service after a failure; they are not used to bring back individual accounts. |
| Rate-limiting counters, kept per keyed hash of the IP address for abuse prevention and not linked to the account. | Within an hour (one daily counter for the no-sign-up entry keeps it up to 24 hours). |
| Server logs. The mail server's delivery log records the addresses and times of messages exchanged with other providers; it is not linked to the account. | Rotated as the server runs. |
| A record that a deletion took place — our staff console writes an audit entry holding the date and the account's internal identifier, not your address or name. | Audit entries are pruned after one year. |
| Your own support message, which stays in our support mailbox like any other correspondence. | As long as we keep support mail. |
Delete only some data instead
You do not have to delete the account to remove data. While signed in you can delete individual emails and threads and then empty Trash, delete chats or single chat messages, unsend a chat message within the first hour, delete secure notes, remove your recovery email address, remove security keys and sign out other devices. Each of these removes that data from our servers while the account stays.
The website's Delete your data page has step-by-step instructions for each kind. See also Delete and restore email.
Your content is encrypted with keys only you hold, so we cannot find or pick out a particular message on your behalf. Anything message-shaped has to be done from the app.
What our server sees
Cannot see
- Your mail, chats or attachments, before or after — we delete ciphertext we could never read
- Your passphrase or password, so a deleted account cannot be "restored" for you
Can see
- That an account existed, and the date and internal identifier of its deletion, for one year
- Your support message, like any other mail to support
Common questions
Is there a delete button in the app?
Not yet. This is a staff action taken on your request; that is true on Android and in the web app alike.
Will my account be deleted if I stop using it?
No. Private.Ki does not delete accounts for inactivity — see Inactive accounts.
Can I get my messages out first?
Not from us. Download what you want to keep while you are still signed in and unlocked; after deletion nothing readable exists, and we never had the keys.
Can I have the username back later?
The address is not reserved for you. Once deleted, the username may become available to anyone.
I want to exercise my GDPR rights.
Deletion and access requests go through the same route. See GDPR for what we can and cannot provide — in short, we can delete everything, and we can hand over only what we can read, which is not your mail.