Data deletion
What deleting a person's data, a whole team or your own account removes, what remains and why, and how long each copy takes to go.
A person's captured data in a team can be deleted in two ways: the person deletes it themselves, or an administrator deletes it when the person leaves. Both run the same deletion, produce the same summary, and follow the same timeline. The team's owner can also delete the whole team, and anyone can delete their own account; both keep a thirty-day window to change their mind.
The timeline
| You do | Right away | Gone from live systems | Gone from backups | What remains, and why |
|---|---|---|---|---|
| Delete your data (in a team) | Deletion starts; progress and a summary in Settings; the summary is emailed to whoever started the deletion | Minutes to hours (target under 1 hour) | Encrypted database backups age out after 35 days | The team's policy-violation records keep date, policy and outcome with your text removed; the team's audit log entries naming you, until its retention (default 90 days); aggregate team statistics recomputed within 1 day |
| Admin removes a member and deletes their data | Same as above | Same | Same | Same |
| Delete team (owner) | The team is read-only: capture stops on every device, members can sign in and download their own data, the owner can restore the team or delete it now for 30 days | Within 24 hours after the 30 days | Encrypted database and key backups age out 35 days after that | Billing records at the payment processor, including the billing contact (seven years, a legal obligation); the deletion summary (ids, counts, dates); Joring's internal operations log (ids and the team name); statistics aggregated across many customers, recalculated within 2 days; security logs with account ids for one year |
| Delete now (during the 30 days) | Same, with no restore | Within 24 hours | 35 days after that | Same |
| Delete your account | Signed out everywhere; devices, browser extensions and API keys stop working; 30 days to sign in and keep the account, or delete it now; teams you own alone are scheduled with it | Within 24 hours after the 30 days, or after Delete now | 35 days after that | The teams you belonged to keep their policy records with your text removed and your name taken off them, and their audit log entries naming you until each team's retention; the deletion summary; Joring's internal operations log (ids); email-delivery records at our mail provider |
From confirming to gone everywhere is at most about 36 days for a person's data: up to a day in live systems, then the 35 days it takes the last backup taken before the deletion to expire. For a team or an account it is about 66 days, or 36 with Delete now: the 30-day window, up to a day for the purge, then the same 35 days of backups.
What is deleted
Everything captured in this team up to the moment the deletion is confirmed, and everything Joring derived from it:
- Captured interactions: the prompts and responses, and the raw captures they were read from
- Conversation summaries, knowledge graph entries and embeddings
- Activity classifications, daily scores, insight narratives and the person's profile in this team
- Workflow sessions, agent and coaching conversations held in this team, trail usage and feedback
- Device diagnostics for the person in this team
The deletion covers one team. Data the person has in another team is not touched.
The Joring Score is recomputed from what remains. If the person has no captured data left in any team, their score, streaks and achievements are deleted too.
What remains, and why
| Record | What is kept | Why |
|---|---|---|
| Policy-violation records | Date, policy and outcome. The person's text, the matched excerpt and its description are removed, and the record is marked as content removed | The team's enforcement history stays accurate without keeping what the person wrote |
| Audit log entries naming the person | Kept until the team's audit log retention, 90 days by default | The audit log is the team's record of administrative actions, including this deletion |
| Aggregate team statistics | Recomputed without the deleted data within 1 day | Team totals are counts, not the person's content |
| Encrypted database backups | Age out after 35 days | Backups are used only to recover the service. If one is ever restored, Joring applies the deletion again |
| Membership, roles and collection settings | Kept while the person is a member | Deleting data does not remove anyone from the team. A member whose collection is paused stays paused |
| The deletion summary | Kept | It is the record that the deletion happened: what was deleted, with counts and dates, and none of the deleted content |
Delete your data
Any member can delete their own data in a team from Settings → Privacy &
Data: choose Delete data… and type DELETE to confirm.
- The deletion starts at once and cannot be undone or canceled.
- It covers everything captured up to the moment you confirm. The page shows its progress while it runs, and you can leave the page in the meantime.
- When it finishes, the page shows when your data was last deleted. Choose View summary to see how many records were removed across which data types, what stays for compliance and when the encrypted backups expire. Download it as JSON from the summary. Earlier deletions are under Previous deletions. The summary is also emailed to you.
Capture continues after a deletion
Deleting your data does not stop new capture. Anything captured after you confirm is stored as usual. Whether capture runs for each person is set in Settings → Activity by the team's Owner and Co-owners, for the whole team or for individual members.
Delete a member's data
Owners, Co-owners, Admins and IT admins can delete a member's captured data. There are two places to do it:
- When removing someone. In the remove dialog on People → Members, choose Delete their data instead of the default Keep their data, and type the person's name to confirm. The member is removed and the deletion starts in the same step. Removing someone still needs the usual authority: you can remove a person only if you hold every role they hold.
- After someone has left. The Removed filter on People → Members shows everyone who was removed or deprovisioned, with the state of their captured data: retained, deleting, deleted, or could not be completed. Choose Delete data… on their row and type the person's name to confirm. People who are still members are not listed: remove them and delete their data in the same step instead. A deletion someone ran themselves while they were still a member does not clear their row: whatever was captured between it and their departure is still there.
The summary is emailed to the administrator who started the deletion. The person can also open it from Settings → Privacy & Data if they sign in to Joring. Whether to tell a former member is the team's decision.
Every deletion is recorded in the audit log as
data_privacy.deletion.requested and data_privacy.deletion.completed, with
the deletion id, who authorized it and the counts.
Delete a team
Only the team's primary owner can delete the team, from the People page. A co-owner cannot; it is reserved the way transferring ownership is. The owner types the team's name to confirm.
Right away the team is scheduled for deletion thirty days out and becomes read-only. Capture stops on every member's devices and browser. Members can still sign in, read what is there and download their own data; nothing can be added or changed. Removing members, revoking roles and withdrawing invitations still work, so offboarding continues. Policy checks answer "allow" and record nothing. The owner gets an email saying so; nobody else is emailed, and every member sees a notice in the app with the date.
During the thirty days the owner can restore the team, which makes it active again at once, or delete it now, which starts the purge within minutes. The owner is reminded seven days and one day before the date. A subscription is set to end at the end of its paid period when the deletion is scheduled; nothing is refunded, nothing is billed again, and restoring the team does not resume it.
At the end of the window Joring deletes everything the team holds: every captured conversation and everything derived from it, policy records, members' roles and settings, invitations, devices, identity provider connections, the audit log, and the team's wrapped encryption keys. A partner-managed team's billing link ends with it, and the partner is told, as the billing party. The purge runs in the background and finishes within a day; the owner then gets the summary by email, and the stored documents and images of the team's trails are removed from storage.
What remains is listed in the timeline above. Members keep their Joring accounts and any other teams they belong to. If a team on custom terms is to be deleted, the contract is ended with Joring first; the product refuses to schedule it until then.
Delete your account
Anyone can delete their own Joring account, from Settings → Profile, by typing their email address to confirm.
Right away you are signed out everywhere: every session, device, browser extension and API key of yours stops working, invitations you sent that nobody has accepted are withdrawn, and open ownership transfers in either direction are canceled. The account is scheduled for deletion thirty days out. Teams you own alone, including a personal workspace, are scheduled with it on the same day. A team you own that has other members blocks the request: transfer its ownership, or delete the team, first. You get an email saying what will happen and when; the teams you belong to record the request in their audit logs.
During the thirty days signing in shows one screen: the date, a button to keep your account, and a button to delete it now. Keeping it cancels the deletion and restores any team scheduled with it; devices, extensions and API keys have to be set up again either way. Nobody else can act on the account meanwhile: an invitation addressed to you cannot be accepted, and an identity provider cannot add you to a team.
At the end of the window Joring deletes everything about you in every team you ever belonged to, exactly as deleting your data does in each one, then your scores, sign-in methods, memberships and the account itself. The teams keep their own records with your name taken off them: policy records stay with your text already removed, and anything you authored for the team, such as a policy or a trail, stays as the team's with no author. The purge runs in the background and finishes within a day, and the summary goes to your email address afterwards.
Accounts created by an identity provider for a team that was deleted, and that belong to no other team, are deleted automatically after the team's purge, without the thirty-day window; the team's window was the notice.
Why it works this way
A team or an account gets a restore window; a person's own data does not. Deleting a team is deleting a container other people depend on, and deleting an account is irreversible for the person, so both follow the model of GitLab's delayed group deletion and Microsoft 365's subscription retention: a fixed window to come back, then a purge on a published schedule. Thirty days is the figure those services use. Signing the person out everywhere at once is what makes the window safe: whoever asked, the real owner of the mailbox learns about it and can sign in to cancel.
A person's own data is deleted at once, with no restore window. This is how the largest services treat a person's own activity. Google removes deleted activity from view immediately and completes deletion from its storage systems in about two months, with encrypted backups kept up to six months (How Google retains data we collect). OpenAI and Anthropic remove a deleted chat from view immediately and from their systems within 30 days (OpenAI: Chat and file retention policies in ChatGPT; Anthropic: How long do you store my data?). Microsoft 365 deletes customer content at most 30 days after a user or administrator deletes it, or an administrator deletes a user (Data retention, deletion, and destruction in Microsoft 365). Joring's live systems finish within hours, well inside the one month GDPR allows for answering an erasure request (Article 12(3), Article 17).
Backups expire rather than being edited. The UK Information Commissioner's Office accepts that data in backups can remain until it is overwritten, provided it is put "beyond use" and people are told clearly what will happen to it (ICO: Right to erasure). Joring states the expiry, 35 days, uses backups only to recover the service, and applies recorded deletions again after any restore.
Encryption keys belong to the team, not the person. Cryptographic erase, as described in NIST SP 800-88 Rev. 2, Guidelines for Media Sanitization, destroys a key so the data under it can no longer be read. It needs a key that covers only the data being erased. A team's encryption key covers every member, so deleting one person's data removes the rows and lets backups age out, and the summary says so.
Team statistics are recomputed, not kept. Counts that cannot identify a person are not personal data (GDPR Recital 26). Joring still recomputes the team's aggregates without the deleted data within a day, so they match what remains.
NextAudit logSee how deletions are recorded and what each entry carries.