Data Deletion, Retention & Containment

Last updated: July 10, 2026

This page explains, in plain terms, what happens when you delete your STYL account: what is removed, how fast, what STYL keeps and why, and the honest limits of "delete" in a system that talks to a database, a file store, and third-party AI providers. It is written to satisfy Apple's App Store requirement that any app offering account creation must also offer in-app account deletion, and to give you the same information a data-protection regulator would expect to see. For the fuller legal picture (rights, legal bases, subprocessors) see the Privacy Policy.

1. How to delete your account

In the app (primary method)

1. Open STYL and go to the Account tab (or tap the account icon in the Closet toolbar and long-press for the quick menu).
2. Choose Settings → Privacy & data, or use the account menu's Delete Account… entry directly.
3. Confirm in the dialog that spells out the consequences ("This permanently deletes your account, every photo, and all closet data. Anonymous, aggregate usage totals are kept but can never be linked back to you. This can't be undone.").
4. STYL calls its deletion service while you're signed in — you don't need to leave the app or visit a website. If it fails (e.g., you're offline mid-request), the app tells you plainly: your account still exists, and you can retry.

This satisfies Apple App Store Review Guideline 5.1.1(v): account deletion is not limited to a web form — it's a first-class action inside the app itself.

By email (fallback, always available)

If you can't get into the app, email support@styl.fit from the address on your account and ask us to delete it. We may need to verify you're the account owner before acting.

2. What deletion actually does (verified against the code, not assumed)

When you confirm deletion, the app calls a server-side function (delete-account) that runs as a single, ordered sequence — deliberately ordered so that if any step fails, your account still exists intact and you can safely retry, rather than being left half-erased:

1. Un-share everything first. Every closet item you'd marked as shared with a close friend is flipped back to private, closing the window where a friend could still view something while your account is mid-deletion.
2. Every photo is swept from storage. The function lists your entire private storage folder (paginated, so it works no matter how large your closet is) and deletes every object in it — not just the photos the database currently references. This is a genuine bucket-level sweep, not a per-row best-effort delete.
3. Your lifetime activity is folded into anonymous aggregate counters (best-effort — see §5) before anything identifying is erased, so STYL can still say "how many photos have ever been tagged" without being able to say whose.
4. Your account record is deleted last. This is the irreversible step. Deleting it cascades through the database and removes every row tied to your account: your closet items and their AI tags, saved and planned outfits, trip plans, folders, generation history, your profile (handle, display name, avatar, styling preferences), your credits/plan record, your device push-notification tokens, your connected-calendar link (including the encrypted calendar refresh token), your follow and close-friend relationships, and your moderation reports (both ones you filed and ones filed against you — see §5 for why that second part is a real tradeoff, not a feature).

3. What we keep, and why: anonymous aggregates

Before your account is erased, STYL folds your lifetime activity into running totals that contain no photos, no handle, no email, no Style DNA content, and no user identifier — pure counts and sums (e.g. "total photos ever tagged," "how many accounts had 0/1/2/3+ close friends"). Once folded in, there is no way to pull your individual contribution back out — the same way you can't un-add your vote from an anonymous tally. This is what lets STYL understand its own usage over time without retaining anyone who has asked to be forgotten. Full detail on what these aggregates contain lives in the Privacy Policy §11.

4. What we can't instantly erase everywhere, and why

"Delete" inside STYL's own database and storage is real and (with the exceptions in §5) thorough. But STYL is not the only place your data has ever touched. Being straightforward about the edges of that:

• AI provider retention (Google Gemini, Anthropic). Tagging a photo or generating an outfit sends that photo or your closet's text tags to our AI provider for the single call that produces the result. Google and Anthropic may retain API inputs for a limited window under their own abuse-monitoring terms, independent of STYL. Deleting your STYL account does not reach into their systems — see the Privacy Policy §4 for what we know about their retention terms, and note we do not control or audit those retention windows ourselves.
• Billing records (Apple, RevenueCat). If you ever subscribed, purchase records are kept by Apple and RevenueCat for financial, tax, and fraud-prevention obligations that outlive your STYL account — this is standard and expected, not a STYL choice to retain more than necessary.
• Email delivery records (Resend). Sign-in and account emails are sent through Resend; their own delivery/bounce logs for messages already sent to your address are not reached by STYL's account deletion.
• Database backups. Supabase (our database host) takes periodic backups for disaster recovery. A just-deleted row can persist inside a backup snapshot until that snapshot ages out on Supabase's own retention schedule — deletion from the live database is not the same instant as deletion from every backup. We have not yet published the exact backup-retention window configured on our project; we will state it here once confirmed against the live project settings rather than quote a number we haven't verified.

5. Known gaps — what isn't fully closed yet (flagged for engineering & counsel)

The items below are real, verified gaps in the current deletion flow — not hypothetical risks. They're listed here so this page never overstates what "delete" does, and so they have a visible home until fixed. See the accompanying technical policy (design/2026-07-09_data-deletion-and-retention.md) for exact file/line references.

• Server logs are anonymized, not deleted. Deleting your account clears the reference from operational logs (tagging results, error logs) to your account, but the log rows themselves are not purged on any schedule we found in the codebase — they persist indefinitely unless an operator manually removes them.
• Moderation reports disappear with either party's account. If someone reports you, and you (the reported person) later delete your account, that report is deleted along with everything else tied to your account — there's currently no separate, longer-lived moderation record that survives the reported user's own deletion.
• A banned account's deletion request can currently be refused. Account deletion is gated behind the same "is this account/IP restricted" check used for abuse prevention elsewhere in the app. A banned account could receive a "this account or network is restricted" refusal instead of having its deletion processed. Being banned should never be a reason to deny someone their right to erase their account — this needs a product/legal decision, not a silent default.
• Deleting a single photo (not your whole account) can leave an orphaned file behind. When you delete one item from your closet, removing the database row is guaranteed, but removing the underlying photo file from storage is a best-effort step that can silently fail. A separate cleanup tool exists to sweep these leftovers, but it isn't run automatically — it must be triggered by an operator.

6. Timelines

• In-app deletion: the account, its photos, and every database row tied to it are normally gone within the same request — typically seconds, not days.
• Email-request deletion: we aim to act within 30 days of verifying your identity — the same outer window data-protection law (e.g. GDPR) allows for such requests — and usually much sooner.
• Anonymous aggregates: retained indefinitely, by design (§3) — never a "delete" target because they were never personal data to begin with.
• Backups: age out on Supabase's own schedule; see the caveat in §4.

7. Deleting individual items instead of your whole account

You don't have to delete your entire account to remove one photo or piece — tap into any item and delete it directly; that photo and its tags are removed the same way (see the known-gap note in §5 about the storage side of a single-item delete).

8. Related pages

This page focuses specifically on deletion, retention, and containment. For the complete picture — what STYL collects, our legal bases, your GDPR/CCPA rights, children's-privacy provisions, and the full subprocessor list — see the Privacy Policy and the Terms of Service.

9. Contact

Questions about deletion or retention: support@styl.fit. This address reaches the operator directly; STYL has not appointed a formal Data Protection Officer.