Your data

Your data is the part of the account that deals with the record the platform keeps about you. It has three jobs: showing what happened on the account in the last 90 days, giving you a copy of what is held, and closing the account when you want it gone. It is for any account owner, and it is the first place to look after a suspicious event or before you leave.

Two of the three jobs are sensitive. Requesting an export and closing the account both need a second factor you used in the last 30 minutes, and both send a security alert to your verified addresses. An account with only a password cannot do either until it adds a second factor.

The tabs run from least to most final. Activity only reads. Export produces a file and changes nothing. Close account deactivates the account at once and starts a 30 day wait before your personal data is erased. What is kept, for how long and why is set out on the Trust pages, and this section explains it from your side without repeating their numbers.

Activity (read)  ->  Export (copy)  ->  Close account                                          |  signed out everywhere, tokens revoked                                          v                                   30 days  ->  erasure of personal data

The order matters. After closing you cannot sign in, so you cannot ask for an export. Take the copy first.

I do not recognise something that happened.

1. Activity: find the event, newest first.
2. The security feed: see whether it was flagged for review.
3. If you think your account was taken over: the checklist.

I want a copy of what you hold.

1. Exporting your data: request it and wait for the email.
2. Exporting your data: download it and check its signature.

I want to leave.

1. Exporting your data: take your copy first.
2. Closing your account: deactivate it with the confirmation phrase.
3. After you close your account: what happens to your data over the next 30 days.

Activity answers what the Account activity table shows, which events from the last 90 days it lists, how the Involvement column relates an event to you, how paging works and how to use it to answer "was that me?". It is wider than the security feed, which picks out only security events.

Exporting your data answers what the signed file contains (profile, email addresses, credential metadata but never secrets, devices, sessions, consents, memberships and your own audit events) and what it leaves out, the five states of a request, how to download and how to check the signature. You can have only one export at a time.

Closing your account answers what to do before you close, what closing does at once (every session, token and personal access token is revoked), how to close with the confirmation phrase, when closing is refused and what to do if you cannot sign in.

After you close your account answers what happens from deactivation to erasure: what is deleted, what is cleared and which records survive because they cannot be edited after the fact. It says plainly that this is not total erasure.

Have a passkey or an authenticator app ready. If you want a copy of your data, request the export before you close, and check that you have a verified address you read, because you are emailed when the export is ready.

How far back does Activity go? 90 days. See Activity.

Does the export include my secrets? No. It never includes password hashes, authenticator secrets, recovery code hashes or token hashes. See Exporting your data.

Can I undo closing my account? Not from the account. See Closing your account.

Is everything erased after 30 days? No. Some records are kept because they cannot be edited. See After you close your account.

Where are the retention numbers? On Retention and deletion.

It does not give the privacy notice, retention periods or the list of what is collected, which are in the Privacy and Retention and deletion pages. It does not cover how to revoke a single application or session, which is in Apps and access and Devices. Short privacy answers are in the Privacy FAQ.