Legal
Your Data — export & deletion
Export everything (self-service, instant)
On your account page, under Privacy & data, "Download my data" gives you one JSON file with everything we hold about your account: profile, email addresses, firm memberships, active sessions, bug reports you filed, and every project and document — including the full content of every saved version, not just the latest. The format is documented inside the file itself. This satisfies the GDPR right to access and portability, and you can run it whenever you like (up to 3 times a day).
Delete specific things (self-service, instant)
Deleting a document or project inside the tools removes it from the live database immediately. Encrypted backups expire on their own 30-day schedule, so deleted data is fully gone from backups within 30 days — this is the same window the Privacy Policy commits to.
Delete your whole account (self-service, with a grace window)
Same place — Privacy & data on your account page. Type your handle to confirm, and:
- You are signed out everywhere immediately, and we email you the deletion date.
- A 14-day grace window starts. Nothing is removed yet — the window exists so a hijacked or regretted request can't destroy your work. Sign back in any time before the date and cancel with one click.
- After the window, the purge permanently removes your profile, emails, sign-in identities, sessions, projects, documents and all their versions, favorites, bug reports, and usage records. Your handle is freed. What remains is an anonymized tombstone, the minimal audit records the Privacy Policy discloses, and one deletion record — your email, handle, the request time and IP, and the purge date — kept for 2 years as proof the deletion happened as requested (and to detect abuse of the deletion system). That record is the legally permitted exception to erasure; it holds no content.
- Backups containing your data expire within a further 30 days.
If you're an owner of a firm (organization) account, transfer or delete the firm first — the product will tell you if this applies.
Everything else (one email, 30-day answer)
Correction of data you can't edit yourself, deletion of data from a specific time period, restriction or objection requests, or questions about any of it: legal@archoverflow.com, sent from an email address on your account (that's how we verify it's you — we don't ask for ID documents). We respond within 30 days, usually much faster. Requests are honored regardless of where you live, and every request and action is recorded in the account's audit trail.
The fine print that keeps this honest
- Deletion timelines here are the same ones the Privacy Policy and DPA §9 promise — one set of numbers, everywhere.
- We never delete your content as a punishment or a billing lever: over-quota or lapsed-plan content goes read-only, never away (Terms §2).
- For firm projects, deletion of firm-owned data follows the firm's instructions per the DPA — your personal account remains yours.