Data Access and Erasure Requests

A signed-in user can open a privacy request from Settings. Available types are account access, portable export, account erasure, and team erasure. Team-wide access, portability, and erasure requests require the current team owner. Destructive team requests also follow the personal-team, active-work, debt, and retention-hold protections.

Before Chab plans or executes a request, the requester must have a verified email, a recent password confirmation, and a recent two-factor confirmation when two-factor authentication is enabled. If the requester cannot use the normal browser flow, authenticated support can send a one-time 30-minute challenge only to the account's already verified email; existing MFA is still required, and Chab does not request identity-document uploads. The request records a seven-day acknowledgement target and a 30-day completion target. A complex request may receive one customer-notified extension of up to 60 days when a reason is recorded before the original deadline.

Each request is pinned to a cutoff and the active data-registry version. If a data checkpoint or the inventory changes before execution, the request returns to review for a new plan. This check runs before erasure starts, so you can still cancel a request that has not begun deleting data. Progress updates for the current request do not invalidate its own approval. Its history is included as recorded while the export is assembled.

Exports include eligible account and project records, login and connection-consent metadata, and relevant mail settings and activity. Mailbox access still limits content access; sharing a mailbox does not expose another user's private views, notification preferences, or follower records. Credentials, authorization codes, session proofs, raw provider responses, and internal operational records are excluded. Saved-view exports include their metadata; saved filter definitions are not currently included. The manifest distinguishes exported records from records retained under a separate policy.

Access exports are AES-256-GCM encrypted with a separate envelope-protected key, are available only to the named requester, expire after 72 hours, and allow at most three downloads per part. Every download requires a password confirmation from the last 15 minutes and, when two-factor authentication is enabled, a fresh authenticator code. The 256-bit decryption key is shown once after generation; save it because Chab does not email it or show it again. Each encrypted file begins with the 12-byte nonce and 16-byte authentication tag, followed by ciphertext. Large exports are split into numbered encrypted parts of at most 2 GiB, with a 10 GiB total limit. Decrypt every part with the one-time key, concatenate the plaintext parts in order, then open the ZIP. The ZIP contains a UTF-8 JSON manifest with file counts and SHA-256 checksums plus newline-delimited JSON data files produced by the registered handlers.

Erasure removes or anonymizes eligible customer content. Financial, policy, audit, security, support-decision, and legal-hold records may be retained and minimized under their separate rules. Team erasure revokes team API tokens before content deletion. Account and team deletion are available only through this verified workflow. The account and team settings link to Privacy Requests. Older direct browser deletion requests redirect there; JSON requests receive 409 privacy_request_required with the page URL, without deleting data. A personal workspace cannot be submitted for team erasure; use account erasure instead. If you own a non-personal workspace, transfer ownership or complete its separate team-erasure workflow before erasing your account so other members' shared content is not removed by an account-only request. Outstanding debt and retention holds block unsafe shared-team deletion rather than silently skipping it.

Account erasure removes external-login identities, session confirmation proofs, and private saved views. Shared team views remain with the deleted user's authorship removed. Pending or uncertain mail actions can delay erasure until their outcome is resolved; their execution records are preserved during that investigation.

The workflow covers data held by Chab. It does not promise deletion of independent records held by another service beyond Chab's contractual controls. Contact authenticated support if verification, a hold, debt, or a failed handler prevents completion.