Right to Delete

When you ask us to delete your account we run a three-stage compliance pipeline. Each stage has a precise legal basis and every step is logged for audit.

• T+0 (now): profile hidden, sessions terminated, recurring subscriptions paused.
• T+30 (30 days): PII purged. Identifiers (email, phone, real name, IP history, OAuth bindings) are erased or one-way hashed.
• T+210 (180 days after purge): forensic skeleton dropped. A final confirmation email is sent. You can sign up again as a net-new account with the same credentials.

The moment you confirm deletion, the public side of your account goes dark — but nothing is destroyed yet. For 30 days you can change your mind.

What happens at T+0:

• Your profile and posts are hidden from public surfaces (feed, search, notifications).
• All active sessions are signed out across every device.
• Active Stripe subscriptions are flagged to cancel at period-end (they un-cancel automatically if you restore).
• We email you a one-click magic-link to undo, plus a reminder five days before the grace window closes.
• Your account state in our admin tooling is pending — a clear signal to BLOQ staff that this account is mid-deletion and must not be touched.

When the grace window expires, an automated worker walks an idempotent purge pipeline. Every step has a progress flag in our database, so a crashed worker resumes from the last successful step — never re-doing work, never skipping work.

Categories purged at T+30:

• Identifiers: email, phone, real name, location, IP history, device data.
• OAuth bindings: Google / Apple identity links are one-way hashed (the "OAuth tombstone"). Re-signing up with the same Google or Apple account creates a brand-new BLOQ Social account.
• Profile fields: display name, handle, bio, avatar, cover image, links, pinned posts — anonymised.
• Your posts: hidden from every public surface (feed, search, profile, hashtags, project pages).
• Direct messages: your half of any DM conversation is removed. The recipient still sees their own messages — we cannot rewrite history they sent.
• Support tickets: body cleared. A reference token is preserved so we can prove the ticket existed without preserving its content.
• Push subscriptions, sessions, and refresh tokens: revoked, never restorable.

For 180 days after the purge, we keep a small forensic skeleton. Each item below has a specific regulatory or contractual reason we cannot drop earlier.

• Audit log entries: who did what, when. Most jurisdictions require 6-12 months. We hold 180 days, the minimum that meets the strictest GDPR / CCPA enforcement guidance.
• Anonymised content on others' threads: a reply you posted under someone else's post is rewritten to "[deleted user]" rather than removed — protecting the other user's conversation history.
• Payment records: Stripe-mandated retention for chargeback windows, tax reconciliation, and PCI-DSS audit trails.
• A compliance vault entry: a single Fernet-encrypted row containing your purged email and the purge date. Used only to send the T+210 final-confirmation email and to satisfy regulator requests during the 180-day window.
• Skeleton user row: a 5-field stub with no PII, used only to keep foreign-key references valid until T+210.

At T+210 the forensic window closes and the second automated worker erases the skeleton.

• The compliance vault row is decrypted one last time, used to send the final confirmation email, then deleted.
• The skeleton user row is dropped. Foreign-key references are nulled.
• Audit log entries are scrubbed of any remaining references to your account ID.
• The OAuth tombstone hash is retained indefinitely — it is a hash, not your data, and it lets us detect (without identifying you) if a Google/Apple sub previously belonged to a deleted account.

After T+210, your account is in state fully_erased. You can sign up again as a net-new account with the same email, phone number, or OAuth provider.

Self-serve, three clicks:

1. Open Settings → Account → Danger Zone.
2. Click Delete Account.
3. Confirm with your current password, type your exact username, and tick the "I understand" acknowledgement.

All three gates must pass before the destructive button enables. We use a stricter triple-gate (password re-auth + literal username match + explicit acknowledgement) rather than a single typed-CONFIRM keyword because it matches the industry standard for self-delete (GitHub, X, LinkedIn, Stripe Dashboard, Discord) and proves ownership rather than just intent.

The moment you confirm, you're logged out and we send the T+0 email with a one-click magic-link to restore.

You have two paths to undo deletion during the first 30 days:

• Click the magic link in your T+0 (or T+25 reminder) email — single click, account restored, all paused subscriptions un-paused atomically.
• Log back in normally with your email and password — you'll see a banner at the top of every page with a Restore Account button. One click and you're back.

We deliberately keep both paths working in case you lose access to your email. Restoring via login proves you still hold the password; restoring via magic link proves you still hold the email — either is sufficient.

In rare cases, BLOQ Social staff may delete an account on your behalf — for example, in response to a Terms of Service violation, a court order, or a regulator demand.

• The same 30-day grace period applies. Admin-deleted accounts are not "purged on the spot" — they enter the identical pipeline.
• Every admin-initiated deletion is audit-logged with the responsible operator's ID, the reason, and the timestamp.
• Unless a specific legal hold requires silence, the account holder is notified via email with the same magic-link restore path as a self-delete.
• An admin cannot skip the grace window, hide the deletion from the audit log, or destroy the compliance vault entry early.

BLOQ Social is a Web3 platform — many users hold linked wallets, creator subscriptions, or active tipping balances. Deletion handles each cleanly:

• Subscriptions you pay: flagged to cancel at the next billing period. If you restore during grace, they un-cancel atomically.
• Subscriptions you sell (creator payouts): active subscribers are notified that the creator account is being deleted; pro-rated refunds are honored where Stripe Connect supports them.
• Linked wallet addresses: the link record is removed at T+30. The wallet itself is yours — we never custody it.
• On-chain tips you received: already in your wallet. Deletion does not (and cannot) claw them back.
• Pending payouts: released to your Stripe Connect account before T+30. If you have a pending payout when you initiate deletion, settle it first or contact support.

This page is the canonical disclosure surface for BLOQ Social's compliance with:

• GDPR Article 17 — "Right to Erasure". Self-serve, no fee, no justification required. Honored within 30 days.
• GDPR Article 12 — transparency on the deletion timeline, the retention basis for each category, and the recipient categories. This page covers all three.
• CCPA "Right to Delete" — California residents, identical self-serve flow, no separate request channel required.
• Recipient categories during retention: Stripe (payments retention), our infrastructure providers (audit-log storage), and regulators on lawful demand. We do not share purged-account data with advertisers or third-party analytics.

The full categories of personal data we collect, process, and retain — including the deletion timeline above — are also covered in our Privacy Policy.

If anything on this page is unclear, or if you have a deletion request that doesn't fit the self-serve flow, write to us. Regulator requests should reference this page's URL.