Delete Account

[lydia-schow]

• Check this box if this is a security vulnerability.

Expected Outcome

I want to be able to completely remove my account from a site. Right to be forgotten, and whatnot.

What Actually Happened

I went to my profile, but couldn't find an option to delete my account.

[paragonie-scott]

That's an interesting suggestion. I'll need to think about this one.

In the meantime, I'd like to open the floor to anyone with specific implementation suggestions or requirements. (Hence: the feedback sought tag.)

[lydia-schow]

Examples

I rustled up some examples from the web. TL:DR; (1) put it near the user's profile; and (2) require their password and confirmation before deleting the account.

Github » Settings » Profile

Paypal » Settings » Account

Tinder » Profile » Settings

[paragonie-scott]

I was thinking more of the backend implementation. Do we soft-delete for N days then have a script that hard-deletes them in the background? (For example: Twitter.)

[lydia-schow]

Could do both. Let the user, admin, or both decide which policy to use.

Personally I tend toward immediate deletion.

Use Cases:

• Destroying all records of 13-year-old me's obnoxious existence.
• Deleting 5 year old accounts from random sites that I don't care about anymore.
• Deleting my account out of disgust/protest at a site's privacy policy change. (i.e. I don't want my data sold.)
• Removing a duplicate/accidental account.
• Deleting an account that has been hacked/defaced.

[geggleto]

@paragonie-scott I believe some country laws require the ability to delete yourself and all of your associated data.

[paragonie-scott]

Then it's probably a good thing we separate "authors" from "users". :)

[geggleto]

For reference: https://en.wikipedia.org/wiki/Right_to_be_forgotten

[lydia-schow]

Concept:

(obviously it doesn't match AirShip's current theme)

[paragonie-scott]

Okay, I'll create a proof of concept over the weekend.

[paragonie-scott]

Well, that PoC never happened.

Upon reflection, I think I should just make account deletion decisive and permanent, but not delete content. There are use cases for soft-deleting, but ultimately that's something that can be implemented upon a client's requests (in respect to their exact needs) in the future.

[paragonie-scott]

Done in 7a6339c