Data and privacy
Account deletion on request
What this control means
Teachers can delete their own account from Settings: everything they made is removed straight away, their sign-in is deleted, any personal subscription is cancelled, and a confirmation email is sent. Live for beta members first; requests by email are handled within 30 days.
What we found
Self-service deletion released on 16 September 2026 to beta members (PR #786, reviewed three times): typed confirmation, one database transaction for every owned record, storage cleanup, Stripe cancellation limited to the person's own subscription, confirmation email, keyed-hash audit row. Tested end to end on production the same day with a throwaway account.
How we verified it
- Audited every foreign key onto the users table in production so that lesson plans and worksheets, which would otherwise be orphaned rather than deleted, are removed explicitly.
- Deletion runs as a single database transaction; nothing outside the database is touched until it succeeds.
- A failed login removal is retried and then the login is banned, so an account can never be left half-deleted.
Still to do
- Open to all accounts after the beta period.
- Automate removal of the marketing-email contact on deletion.
Evidence (private, draft only): kuraplan-st4s-evidence/06-data/2026-09-15-backups.md
Questions about this control: security@kuraplan.com