Delete account
Ritmola first requires recent authentication and your confirmation, then asks the app-specific Worker to delete the Firebase Authentication account and, when configured, the exact environment-scoped RevenueCat customer. The Worker stores the target in an encrypted durable job and retries until provider readbacks confirm absence. An accepted or queued deletion response means processing has started, not that deletion is complete; the app shows processing while confirmation is pending. There is no fixed completion time. If a request was not accepted and the app confirms cancellation, the local account profile remains available so you can retry. Once the Worker durably accepts the request, Ritmola clears the signed-in local profile and switches to the separate guest profile. If the app is interrupted before the remote result is known, the next launch clears the pending local account profile before opening another profile and keeps the hashed identity fence; check the deletion status before trying again. If local clearing fails after acceptance, account-profile access stays blocked behind a retry gate until clearing succeeds. The Worker completion status is reported only after the configured provider records are confirmed absent.
Account-erasure processing and retained data
When account deletion is enabled and you confirm it, the app-specific Worker stores a durable erasure job in encrypted D1 storage. Its encrypted payload contains the Firebase UID and, when RevenueCat cleanup is enabled, the environment-specific RevenueCat customer ID derived from that UID. The D1 row uses a SHA-256 hash of the random request receipt and an environment-scoped HMAC-SHA-256 user index; the raw Firebase ID token and email address are not stored in erasure fields or Worker logs. Pending jobs do not expire and are retried until Firebase Authentication confirms the account is absent and, when enabled, a readback confirms that the exact RevenueCat customer is absent in the validated project. A queued provider response is not completion. After completion, the encrypted target and receipt are retained for seven days and rechecked every 15 minutes; scheduled cleanup then removes them. A cancellation tombstone contains no UID or customer payload and expires after 24 hours. This erasure job does not include local plans, session history, or Apple billing data. Provider logs and records kept outside this job follow the applicable provider policies or legal retention requirements.
Account-erasure processing and retained data
The encrypted local erasure tracker keeps a SHA-256 account-scope hash, request ID, and status while a request is pending or uncertain and after it completes. This minimum local fence prevents the same sign-in identity from recreating its RevenueCat customer. It does not contain the raw Firebase UID, email address, or authentication tokens. A server-confirmed cancellation removes the erasure record.
Retention, export, and deletion
Guest profile data is separate and is not deleted by deleting a signed-in account. Clear it separately from the app. Exported copies are outside Ritmola's control.
Account deletion and subscription cancellation are separate. Use Account for account requests and Plus or your app store account to manage billing. Deleting an account or local data does not itself cancel a store subscription.
Account deletion does not cancel an Apple App Store subscription or erase Apple's billing records. Manage or cancel a subscription separately in your Apple account. RevenueCat/Apple may keep transaction records under their own policies.
If the deletion control is unavailable, contact support to report that the control is missing. Do not email a password, sign-in code, or verification link.