← Back to home

Data Deletion Policy

Last updated: 20 May 2026

This page explains how to delete your KiraKiraLah account, exactly what data is removed, what is retained and for how long, and what happens to data held by third-party processors.

1. How to Request Deletion

There is currently no self-serve account deletion button in the app. To delete your account and data, email:

[email protected]

Subject: Account deletion request — [your account email]

I will verify your identity against the account email before proceeding. Deletion will be completed within 30 days of the verified request. You will receive a confirmation email when done.

This action is irreversible. Deleted data cannot be recovered. If you only want to stop being charged, see Refund & Billing Policy — cancelling a subscription does not delete your account or data.

2. What Gets Deleted

Upon confirmed deletion, the following data is permanently removed from the primary database within 30 days:

  • Account record — name, email address, profile picture, account role
  • Authentication data — hashed password, linked OAuth accounts (Google), all active session tokens
  • Financial records — all expense entries, income entries, categories, recurring configurations, and any uploaded receipt files or attachments
  • Subscription references — Stripe customer ID, subscription ID, Polar customer ID, plan status stored in our database
  • Activity logs — all in-app activity records associated with your account

3. What Is Retained After Deletion

Some data cannot be deleted immediately due to technical constraints or legal obligations:

Database backups

Automated database backups (held by Neon DB) may contain your data for up to 30 days after deletion from the live database. Backups are encrypted and are only used to restore the database in the event of a catastrophic failure — they are not used for any other purpose and are not individually accessible.

Error reports (Sentry)

Error reports that reference your user ID or email may remain in Sentry for up to 90 daysper Sentry's default retention policy. These reports contain stack traces and metadata, not financial records.

Payment processor records (Stripe / Polar)

Stripe and Polar are required by financial regulations and their own policies to retain transaction records (payment history, invoices, customer records) independently of any deletion request made to me. These records are outside my control. To request deletion of data held directly by these processors, contact:

Aggregated or anonymised data

Where data has been fully anonymised (no longer attributable to you), it may be retained indefinitely for general service improvement. This does not apply to any financial records.

4. Retention at a Glance

DataDeleted from live DBFully purged by
Account, auth & financial recordsWithin 30 days of request30 days after request
Active sessionsImmediately on confirmationImmediately
Activity logsWithin 30 days of request30 days after request
Database backups (Neon)Not individually deletable≤ 30 days after live deletion
Error reports (Sentry)Not individually deletable90 days from creation
Payment records (Stripe / Polar)Outside my controlPer processor policy

5. Malaysian Users — PDPA

Under Malaysia's Personal Data Protection Act 2010, you may request the deletion of your personal data where it is no longer necessary for the purpose for which it was collected, or where you withdraw consent and no other legal basis applies. Requests are handled as described in Section 1. I will respond within 21 days as required by the PDPA.

6. Contact

For deletion requests or questions about this policy:

Email: [email protected]