Data deletion and retention
What changes when you delete a note, leave a workspace, cancel renewal or delete an account.
At a glance
Choose the scope carefully. Local data, hosted content, shared contributions and operational records do not all disappear through the same action.
Local notes and keys
A local device can hold notes, attachments, decryption material and unsent changes. Central account deletion is not proof those copies have been erased. Protect and verify needed work before local removal. Removing one account must not erase another authenticated account’s keys or drafts.
Identity and membership
Leaving a workspace changes that membership. Deleting an account changes the service identity. A sole owner must resolve ownership or closure first. An account deletion should name the personal and workspace dependencies, relevant subscriptions and the effect on support access.
Billing, support and operational records
Invoice records, support correspondence, vulnerability reports, diagnostics and security logs serve different purposes. Their retention must be justified and access limited accordingly. A spam label is not a reason to keep sensitive messages indefinitely. Exact periods and exceptions require system-owner and legal review.
Backups and restore behavior
Backup retention and deletion propagation must be explained honestly. A restore process must not silently reintroduce data previously removed. Any legal or security hold needs a defined scope and authorized purpose. Encryption does not eliminate retention obligations for operational information.
Understand the result
Received, scheduled, processing and completed for a particular scope are distinct states. A timeout is not proof a deletion failed. Reconcile the existing request before repeating a destructive action, and state any reviewed exception or unresolved dependency.
Take the right next step
Use the native app to check device-local work, export and recovery readiness. Use the account portal for membership and service-identity changes. Use the actual biller to manage renewal or a refund. The final retention schedule must be published before these flows can promise a duration or irreversible purge.