User Data Deletion
Controls for conversation, workspace, account and Meta data deletion.
This document is provided in English.
Check a Meta deletion request
Enter the confirmation code returned after a signed deletion request, from either Meta app.
Delete data inside Responses
- Conversation history: the workspace delete-history control removes the conversation, its messages and reports filed against that conversation.
- Workspace: an owner can use the workspace Settings screen — on the web or in the iOS and Android apps — to delete the workspace and its messages, conversations, reports, connected accounts, encrypted platform credentials, knowledge, membership and configuration records.
- Account: on the web, use Account → Settings → Delete account. In the iOS and Android apps, open the Account screen and choose Delete account from its menu. A registered user must confirm the account password; a guest account has none, so its live session is the confirmation and the apps ask for no password. Workspaces owned by the account are deleted and memberships in other workspaces are removed. Deleting an account in the apps signs the device out and does not open a replacement guest session. If you cannot sign in, request deletion directly at support@responses.me.
- Export: an account holder can export account-level records, and a workspace owner can export workspace, membership, channel, conversation, message, assistant, knowledge, moderation and configuration data as JSON. Authentication secrets, platform credentials and token hashes are excluded.
- Disconnect a channel: disconnecting removes its stored platform credentials. Content deletion is a separate action.
Workspace or account deletion is refused while relevant OAuth, webhook, queued outbound or AI work is still running. Retry after the process finishes. These privacy actions remain available even when a new Terms version has not yet been accepted.
Subscriptions during account deletion
If a Stripe billing profile exists, account deletion asks Stripe to delete that customer before deleting the local account. Apple App Store and Google Play subscriptions are owned by the respective store and must be canceled using that store's subscription controls; deleting a Responses account does not itself cancel a store-managed renewal.
Deleting Meta data
Responses uses two separate Meta apps, and a deletion request reaches whichever one you sent it to. They hold different data, so the outcomes differ and one request never covers both.
A connected Facebook or Instagram inbox
This is the app a business authorises to work its channels. Meta sends an app-scoped user identifier in a signed deletion request; the API verifies the signature, finds connected Facebook or Instagram accounts matching that identifier, and deletes their messages, reports, block records, conversations, webhook events, platform credentials and connected-account records. It then returns a confirmation code and a status URL.
Signing in with Facebook
This is the separate app behind the “Continue with Facebook” button. A deletion request there removes the sign-in identity: the app-scoped identifier Facebook gave us, the address it supplied, and every open session that identity had. Its identifiers come from a different app than the one above, so the two never resolve to each other.
Your Responses account is not deleted by that request. It holds work done here — workspaces, conversations and billing — which Facebook never supplied. If signing in with Facebook was the only way into the account, it stays recoverable through support@responses.me rather than being erased on an assumption. To remove the account itself, use account deletion above.
Status records for either kind contain the confirmation code, the app-scoped identifier, the scope, status, what was removed and timestamps. They have a 180-day database TTL.
Contact
If self-service or Meta deletion does not cover the request, contact support@responses.me. If you are a person who messaged a business using Responses, that business normally controls the conversation and may need to handle the request.
Records with separate expiry
Database TTLs continue to govern content-free audit and security records and provider-event idempotency records as described in the Privacy Policy. The repository's encrypted Mongo backup script rotates local and rclone-backed remote archives after 30 days by default. An scp destination must enforce its own retention. External provider retention is not defined by application code.