Delete your FamilyPlan account and data

Email support@familyplan.cloud from the address used for your FamilyPlan account. The email starts the request; it does not by itself authorize deletion.

The verified path in the FamilyPlan web app is:

1. Sign in at familyplan.cloud/app.
2. Open “Settings”.
3. Expand “Data & account”.
4. Select “Delete account”.
5. Enter the exact confirmation shown and select “Delete permanently”.

In its current version, the Android app already offers “Leave family” and “Delete family” under “Settings” → “Data & account”, but it does not yet show a separate “Delete account” action. Until that action is added, use the web app or the verified email request above. This notice will be updated when the Android action is available.

• The protected Edge Function prepares deletion of the signed-in Supabase Auth user, including the email address, login identities and authentication mapping, and deletes it when the process completes successfully.
• Account memberships are removed. In a family that continues to exist, the linked profile is disconnected from the login, renamed to “Deleted account”, and its PIN and login link are removed.
• Current location values and sharing grants for the linked profile are removed. User-bound push tokens, notification deliveries and private FamilyPlan Assistant cloud history are linked to the Auth user ID and are removed with the Auth user.
• A pseudonymous deletion audit remains. It contains a SHA-256 hash of the former user ID, the action, affected family IDs, result and timestamp—no email address or password.

If the account is the only family member or the last parent account, the backend deletes the whole family. Cascading database relationships then delete profiles, memberships and invitations, calendars and reminders, tasks and routines, shopping lists, chat, meals, recipes, school and holiday data, points, rewards, budgets, family home location, weather cache, current locations, location sharing, Assistant history and family-bound entitlements.

If another parent keeps the family active, shared content needed by that family remains. This can include events, tasks, lists, messages, meals, recipes, school, rewards and budgets. It remains linked to the family or neutralized profile, not to the deleted login, so one account deletion does not unexpectedly destroy the other family members’ organization.

FamilyPlan stores family and profile pictures in the private Supabase Storage bucket “family-media”. The current automated account flow removes related database rows or references, but it does not yet contain a verified automated purge for every Storage object.

If you uploaded pictures, use the email request so we can review the affected media after secure verification. Media still required by other family members as shared family content must not be removed for everyone without clarification; any personal association with the deleted account must still be removed.

• Deleting a FamilyPlan account does not cancel a Google Play or Apple subscription. Subscriptions must also be managed or cancelled in the relevant store.
• For Google Play, FamilyPlan processes product and package IDs, purchase token and token hash, family and user mapping, order ID, subscription state, acknowledgement state, expiry and verification times. Verification is performed server-side through the Google Android Publisher API.
• When a family is deleted, family-bound entitlements, Google Play mappings and FamilyPlan billing rows are deleted through the family relationship. When a family continues, family-level purchase evidence and Premium mappings may remain; the direct user ID on Google Play token records is set to null.
• Store providers retain their own purchase and payment records under their rules and legal obligations. FamilyPlan cannot delete those external records through a FamilyPlan account deletion.

• Family and account data: until the relevant item, family or account is deleted; shared content follows the continuing-family rules above.
• Technical Assistant run diagnostics: automatically deleted after 30 days. Assistant chats: until a chat or all history is deleted, cloud history is disabled, or the account/family is deleted.
• Tax and billing records: where the respective legal classification applies, ten years for books and records, eight years for accounting vouchers and six years for other tax-relevant records; periods generally start at the end of the year in which the record was created (section 147 of the German Fiscal Code).
• Deletion audits, website page views, support email and Chatwoot conversations: the current project does not configure a fixed automatic deletion period. They are kept only for security, evidence, statistics or support and reviewed for deletion when that purpose ends or upon a valid request, unless a legal obligation applies.
• Backups: deleted data may remain until existing Supabase backups rotate. No fixed backup period is evidenced in the repository at present.

• Individual events, tasks, list items, chats, meals, recipes, school and budget records can be deleted in their respective sections.
• Assistant chats can be deleted individually or in full, and cloud history can be disabled.
• Location sharing can be revoked, and current locations are removed when leaving a family.
• Under “Settings” → “Data & account”, users can leave a family. Parents can delete an entire family and its cloud data.
• Signing out, clearing Android app data or uninstalling removes local app data from that device; it does not automatically delete cloud data.