Account and Data Deletion

Requests and identity verification

You can read this page and request deletion without signing in or reinstalling the app. Send account or data deletion requests to [email protected]; the individual developer monitors and handles them. You may use “Account and data deletion request” as the subject. See below for the information needed. Sending a request or opening this page does not complete deletion; rely on the handling response.

In versions that support in-app account deletion, open Me → Account security → Delete account, review the consequences, receive an email verification code and enter it in the app, then confirm permanent deletion. Never send the code to anyone by email. If an older version only opens these instructions, you cannot access your account or the service is unavailable, use the email route above; reinstalling or upgrading is not required to submit an email request.

Permanent deletion has no cooling-off or recovery window. Deletion proceeds after verification and any required subscription handling, without waiting for membership to expire. If a network or processing error occurs, rely on the explicit result or saved deletion receipt to check progress. Account deletion and completion of file or device cleanup are separate states; selecting Confirm alone does not prove that both are complete.

Data actions currently available

You can edit or delete entries within your app permissions, update your profile, leave joined ledgers and withdraw optional permissions in system settings. Deleting an entry removes it from normal entry display, but a server-side deletion marker does not immediately erase every stored copy.

Local caches, exported files and copies you shared are separate from server account data. Clearing device data does not delete server records. Server processing cannot remotely recall copies held by other people.

What permanent deletion removes

Permanent deletion removes account identity, login and linked sign-in information, your own entries in every ledger (including entries already marked deleted) and their images, your budgets, recurring templates and execution records, personal settings and membership grants. Your custom categories are also removed; references to them in retained records become “Uncategorized”. Necessary transaction records are retained separately as described below.

The current device clears login credentials, cached entries and images, location history, favourites and other data for that account. Offline devices may still hold cached data until they reconnect and verify the account state. Immediate clearing on offline devices is not guaranteed. Exported files, screenshots and copies already shared cannot be remotely recalled.

If older local caches cannot be reliably linked to an account, they are isolated and drafts are preserved while sync results are checked. Remaining unverified data is not cleared automatically. You can first export drafts reliably identified as your own under the current account, then explicitly confirm the local cleanup described on screen. Data belonging to another account or with unknown ownership is not available to the current account for viewing or export. Device cleanup remains incomplete until this is resolved. This action does not delete server records or files you have already exported.

File cleanup may need retries. If the account has been deleted while attachments are still being cleaned up, these are separate states; cleanup retries do not restore the account.

Shared ledgers and other members’ entries

Ledgers owned by the departing user become read-only and are not transferred. They no longer allow new entries, invitations or management changes. Existing members keep only their previously authorised viewing access. The departing user’s own entries in these and other ledgers are deleted; other members’ entries and images remain.

The authors of retained entries can still view and edit their own entries. Saving an owned entry or unsynced draft that refers to a read-only ledger moves it on the server to that user’s valid, writable default ledger. If none exists, saving fails; select or set a valid default ledger before retrying. A new ledger is not created automatically. This does not permit editing someone else’s entries.

Shared content already cached or exported by others cannot be remotely recalled. After the client refreshes, actually deleted entries are no longer shown. Exported copies remain under their holders’ control.

Recurring entries, budgets and statistics

All recurring templates created by the departing user stop and are deleted. Other members’ templates in read-only ledgers remain paused. They can be re-enabled after selecting a valid ledger, without automatically backfilling entries for the paused period.

Other members’ affected budgets remain, with invalid ledger associations removed, and are disabled without automatic resumption. Review their scope before re-enabling them. The departing user’s own budgets are deleted.

Retained entries continue to count in their authors’ personal home and income/expense statistics, even while still in a read-only ledger. After refreshing, only actually deleted entries are excluded. Other users’ current or historical badges are not automatically withdrawn because of these deletions.

Retention and cleanup of necessary records

Orders, refunds, purchase tokens, payment notifications and necessary associations are retained separately from the deleted login account for later refunds, reconciliation, late notifications and preventing incorrect reassignment of old purchases. These records may still relate to a purchaser and are not considered fully anonymous. Keeping them does not require retaining a usable login account or your personal entries.

These transaction records are not automatically deleted with the account and have no fixed automatic expiry; they remain until manual cleanup. Contact the privacy email to request further deletion. If pending refunds, transaction checks or another necessary reason requires retention, the response should explain the scope and reason.

Server runtime logs follow the rotation rules in the Privacy Policy; account deletion does not promise immediate removal of each log entry. Exported copies and data independently processed by Google or other third parties need to be handled through the respective holder or provider.

For in-app feedback, permanent account deletion clears the account association, contact details and diagnostics, and deletes attachments through the cleanup process. Submitted text and necessary handling records remain without a fixed automatic expiry; text containing personal information is not automatically anonymised. Contact the privacy email with the feedback number where available to request further deletion. Device cleanup also removes this account’s feedback drafts, temporary attachment copies and pending-submission markers; original files in your photo library are unaffected.

Deletion and Google Play subscriptions

Permanent deletion first checks associated Google Play subscriptions and requests a stop to future payments where still needed. The original subscription cannot be restored after this type of cancellation. If the channel cancellation fails or its outcome is unknown, deletion does not complete; the account remains and you may retry. Payments already stopped successfully do not automatically resume.

Ordinary cancellation usually preserves access for the paid period and does not delete M-Jot data. Permanent deletion does not wait for that period to end. After success, remaining VIP, prepaid and lifetime membership on the original account cannot be used or restored. If you only want to stop renewals, use ordinary cancellation in Google Play.

Deletion does not automatically request a refund or waive applicable refund or consumer rights. After deletion you can still request a refund review through Google Play or the contact email on this page. Pending refunds continue and do not require a new account. For requests sent by email, check the actual subscription status in Google Play; sending a deletion request alone does not stop billing.

If a new purchase is first received after permanent account deletion, and its benefits have neither been delivered nor confirmed as delivered to Google Play, Google will automatically cancel and refund that purchase. This does not apply to purchases whose benefits were delivered before deletion, and M-Jot does not initiate this refund.

Registering again and old purchases

Using the same email or Google identity after permanent deletion creates a completely new account. The old account, entries and membership are not restored, and the cumulative free budget activation allowance is calculated afresh. Old purchases cannot be attached to the new account through purchase restoration or payment retries.

Late payment notifications and refund results only update retained transaction records. They do not recreate the deleted account, profile or membership.

Information for an inquiry

When submitting a request, provide your M-Jot identifier or registration email, request scope and a reply address. Identity checks should use only necessary information. Do not send passwords, verification codes, full statements or full purchase tokens.

Shared-ledger handling may affect others. Review any records you need to keep before requesting action. Paid app export entitlements are distinct from statutory personal-data rights.