Account Deletion Policy

This policy describes what happens when you delete your AlcheMagic account, how long the deletion takes, and what data we retain (and why) even after deletion.

Related legal docs in this directory:

Privacy Policy §7 (retention table), §8 (right of erasure), §10 (children).
DSAR Procedure §1 (self-service), §7.3 (erasure confirmation template).
Terms of Service §10 (termination).
Age Rating, COPPA & GDPR-K Policy §3 (parental requests).

1. How to delete your account

Channel	Steps	Verification
In-app (self-service, recommended)	Settings → Account → Delete my account → type "DELETE" → confirm.	Active Game Center session — no extra step.
Email	Email `privacy@arcaneduck.com` with subject `Delete my account — <Game Center display name>`.	We confirm identity per the DSAR Procedure §2.
Parental request (child accounts)	Email same address; provide proof of parental relationship.	See the Age Rating, COPPA & GDPR-K Policy §3.

2. What gets deleted (cascade scope)

The in-app delete and the email-channel delete trigger the same cascade, authenticated and rate-limited 3/hour/session.

The cascade removes:

Data	Storage	What is removed
Player record	`players/<hashed-id>` (FS now; Postgres after I1 migration)	The HMAC-hashed Game Center id binding; display name; language; consent flags.
Sessions	`sessions/*` filtered by player	Every active and expired session token (already hashed).
Cloud save	`player-progress/<hashed-id>`	Game progress, settings, owned upgrades, achievement state.
Entitlement bindings	`entitlements/<hashed-id>`	The link between purchase records and the hashed player id (see §3).
Pending IAP / IAP webhook state	`transactions/*` filtered by player	Pending and resolved transactions linkable to the account.
Autotune / devtools state	runtimeStorage kinds tagged with player	Anything keyed by hashed player id.

All deletions are synchronous within the request handler — by the time the API returns 200, the data is gone from primary storage. Backups are scrubbed within 30 days.

3. What we retain (retention exceptions)

We retain the following pseudonymized data after deletion, with the legal basis noted. None of the retained data alone can identify you.

Data	Retention	Legal basis	Pseudonymization
Purchase records (`originalTransactionId`, product id, amount, refund state)	7 years from purchase	GDPR Art. 6(1)(c) — tax + accounting obligations (varies by jurisdiction; 7 years is the EU upper bound)	The link to the hashed player id is removed. What remains is the raw Apple data, which is keyed by `originalTransactionId` only.
Audit log entries about the deletion itself	Indefinite	GDPR Art. 6(1)(f) — legitimate interest in proving lawful processing (DSAR audit trail)	Stored as `{action: "account_deleted", deletedAt: <iso>}` only — no identifier present.
Aggregate analytics already sent to GameAnalytics / Crashlytics	Per processor (90 days at GameAnalytics; 90 days default at Crashlytics)	GDPR Art. 6(1)(a) — consent given at the time the data was sent	Already pseudonymous at the processor; we cannot recall individual events.
Backend access log entries	30 days	GDPR Art. 6(1)(f) — security investigation	Already keyed by hashed player id; entries naturally age out.

Apple's own purchase records (held by Apple) are subject to Apple's retention policy, not ours.

4. SLA

Step	Time
In-app deletion executes	Immediate (synchronous within the API call; typically < 1 s).
Email-channel deletion ack	5 business days (per the DSAR Procedure §4).
Email-channel deletion executes	Within 30 days of receipt (GDPR Art. 12(3)).
Backup snapshots scrubbed	30 days from primary deletion.
Processor-side deletion (GameAnalytics, Crashlytics)	Per processor's retention window (typically 90 days from event upload, not from deletion request).

The 30-day backup window is the longest tail; after 30 days, no copy of your data exists in our systems other than the §3 exceptions.

5. Re-creating an account after deletion

If you sign in again with the same Game Center identity, a new account is created. The cascade is irreversible: previous progress, purchases, and entitlements are not restored. Non-consumable purchases can be re-granted via Restore Purchases (see the Refund Policy §5) because Apple retains the receipt.

If you delete in error, contact privacy@arcaneduck.com within 7 days of deletion. If the backup snapshot has not yet been scrubbed and the deletion was via email channel (not the in-app "DELETE" confirmation), we may be able to restore. In-app deletions are not reversible.

6. Children's accounts

Parental deletion requests follow the same cascade. Apple Family Sharing accounts where the parent has approval over IAP receive the same treatment.

If we discover an account belongs to a child under 13 (US) or under 16 (EU) and we have no verifiable parental consent for the data collection, we delete it within 30 days of becoming aware — see the Age Rating, COPPA & GDPR-K Policy §3.

7. Account suspension vs. deletion

Action	Reversible?	Data	Trigger
Suspension	Yes (manual unsuspend by support)	Frozen, not deleted	Acceptable-use violation, fraud signal, refund-abuse pattern.
Deletion	No (modulo §5 7-day window)	Removed per §2	User request (in-app or email); confirmed bad-actor account; legal order.

We do not auto-delete inactive accounts. Cloud save data is retained until the user deletes (per the Privacy Policy §7).

8. Operational audit

The DSAR registry tracks every email-channel deletion. Self-service deletions are tracked in the audit log ({action: "account_deleted"}). The audit log retention is described in §3.

Quarterly metrics:

Total deletions (in-app + email).
Median + p95 time to completion.
Reversal requests received within the 7-day window.
Any deletion that missed the 30-day SLA (target: zero).

Aggregated metrics feed the DSA transparency report (see the EU Digital Services Act Contact Point §7).