Data and Account Deletion

Status and contact

Effective date: 16 August 2026. Last updated: 16 August 2026. This page covers deletion choices for the public ChannelCockpit website and the protected ChannelCockpit app and service.

The monitored contact for privacy and account-deletion requests is support@channelcockpit.app. It is a real request and correspondence channel even if you cannot sign in or no longer have app access. Through this channel, Support can receive a request, verify identity or authority proportionately, respond, and handle applicable privacy-rights obligations.

An email request does not automatically start deletion. ChannelCockpit first identifies the requested action and may ask only for information proportionate to the data at risk to verify identity or authority. This protects account and platform data from deletion or disclosure to the wrong person.

The Contact form is an operational second intake route and forwards accepted messages to the monitored support mailbox. It does not automatically start an account-deletion lifecycle. A Contact message remains a correspondence request until Support identifies the requested action and completes any proportionate identity or authority checks.

It usually helps to state the email address associated with the account, whether you want account deletion or a privacy-rights response, and any platform or content needed to locate the data. Do not send a password, access token, recovery code, private media file or identity document unless ChannelCockpit explains why a specific item is necessary through the monitored contact.

Choose the right path

1. Export first if you want a product copy. Use the authenticated account export before deletion, because permanent deletion removes access to it.
2. Use in-app account deletion when you can sign in. The control is in Account privacy and starts the server-confirmed lifecycle described below.
3. Use email when app access is unavailable. Send the request to the monitored address above. Support can receive, verify and respond to it, but the email does not itself start account deletion.
4. Use Disconnect if you only want to remove one connection. Disconnect is narrower than deleting the ChannelCockpit account.
5. Use the provider's controls for provider-held data. ChannelCockpit cannot erase a YouTube, TikTok, Instagram or Facebook account or content held only by that provider.

Export first

An authenticated account holder can request an owner-scoped, bounded JSON export. The current export is limited to 10,000 owner documents and 20 MiB. It can include account and provider-connection metadata, owner-scoped Firestore records and export-safe publishing-media metadata such as a sanitized file name, media type, content type, size, status and lifecycle timestamps.

The product export does not include media binaries, operational logs, credentials or secrets. Token, password, cookie, secret and session-URL fields are redacted or excluded. This optional convenience export is not a complete Article 15 GDPR access response and does not replace a privacy-rights request.

The JSON object is available for 10 minutes, the signed download URL for two minutes, and cleanup runs every five minutes. A verified download asks for earlier cleanup. The configured Cloud Storage bucket has a seven-day soft-delete period, during which a deleted object can remain recoverable within the provider's protected storage.

Disconnect a platform

Disconnecting one platform is not account deletion. It removes the local credential and active access for that connection, attempts provider revocation on a best-effort basis, and removes provider-linked publishing identifiers, checkpoints and other connection artifacts.

User-authored scheduled content can remain in ChannelCockpit after a disconnect. TikTok account and video history can remain until its 90-day expiry unless permanent account deletion purges it earlier. Disconnect does not remove the ChannelCockpit account, erase an unrelated platform connection, or delete content and account data held by the provider.

Permanently delete your account

In the authenticated app, permanent deletion requires recent authentication and explicit confirmation. The app waits until the server confirms that the request was accepted into the deletion lifecycle. That confirmation means the protected asynchronous process has started; it is not a promise of immediate physical erasure from every active system, backup or provider system.

Once accepted through the current authenticated control, the account becomes unavailable and the deletion cannot be undone. The authenticated in-app control is the only currently evidenced automatic technical trigger for the server-owned deletion lifecycle.

If you are locked out, the external request remains valid: you are not required to return to the app to submit it or receive a response. Support will verify the request proportionately, explain the available account or privacy path, and handle applicable privacy-rights obligations. The external message itself is not represented as an automatic product command.

If account deletion cannot be completed through the authenticated product path, Support will state the reason, provide an available alternative next step, and explain the requester's applicable statutory rights and complaint route. ChannelCockpit does not state that deletion was completed until the relevant lifecycle or rights response supports that statement.

Deletion lifecycle

The server-owned lifecycle applies the following safeguards and cleanup stages:

1. Secure the account. The identity is disabled, Firebase refresh tokens are revoked and new owner writes are barred.
2. Purge owner data. Owner-scoped Firestore records, private publishing media, temporary exports, rate-limit state, publishing operations and platform credentials are deleted.
3. Remove connections. Local credentials and platform artifacts are removed, while provider revocation is attempted on a best-effort basis without delaying local credential deletion.
4. Remove the login identity. After the owner-data purge completes, the Firebase Authentication identity is removed.
5. Reconcile late or interrupted work. Reconciliation runs hourly throughout a 24-hour deletion barrier so interrupted cleanup and late owner writes are retried or removed.

A transient failure can leave the request in a deleting state while reconciliation continues. “Request accepted into the deletion lifecycle” is therefore the accurate acknowledgement; “everything was erased immediately” is not.

Timing and residuals

ChannelCockpit removes active owner access and data through the lifecycle above. Some protected residuals can remain for a bounded provider, safety or legal reason:

• Deletion barrier: hourly reconciliation covers interrupted work and late owner writes for 24 hours after acceptance.
• Google and Firebase: Firebase states that other Authentication information is removed from live and backup systems within 180 days after customer-initiated user deletion. The applicable Google Cloud deletion terms also set a maximum of 180 days unless applicable law requires storage. These are provider-backend outer periods, not continued account access.
• Meta receipt: the opaque connection-deletion receipt described below expires after 90 days and contains no raw provider user identifier.
• Legal hold: a narrowly selected record is retained only if a legal obligation or the establishment, exercise or defence of legal claims requires it. Access remains restricted and the record is removed when that need ends.
• Support and verification: minimized support correspondence, identity or authority verification data and compliance records remain restricted and are deleted when their request-handling purpose ends, unless a legal obligation or related legal claim requires longer protected retention.
• Security and operations: pseudonymized security and operations logs can remain after owner-data deletion. These records remain protected and are deleted when their security, reliability or compliance purpose ends, unless a legal obligation or related claim requires longer retention. The Privacy Policy explains the applicable provider and purpose-based retention boundaries.
• Account export: the object, URL, cleanup cadence and seven-day Cloud Storage soft-delete period are described above.
• TikTok history: local account and video history normally expires after 90 days, but permanent account deletion purges it earlier through the deletion lifecycle.
• Publishing media: outside account deletion, an incomplete upload binding expires after 24 hours. Saves, updates, reviews and terminal transitions bind media through seven days after the relevant action; scheduled media is bound through the scheduled instant plus seven days. Permanent account deletion requests the earlier owner purge, subject to the residual periods on this page.
• Publishing controls: outside account deletion, preflight records expire after 24 hours, operations and terminal queue records after 30 days, and provenance records after 90 days. Permanent account deletion requests their earlier owner purge.

Public website data

The public site's display preference stays only in local browser storage. A visitor removes it when they use the reset control, clear browser storage or let the browser remove it. Public-site hosting and security logs follow the periods and unresolved configuration boundaries in the Privacy Policy; account deletion does not remotely clear browser storage on a visitor's device.

Provider-held data

ChannelCockpit removes its own stored connection data and attempts supported revocation, but provider-held data remains subject to the provider's own controls and policies. ChannelCockpit cannot guarantee a provider's response, approval, timing or deletion of data held in that provider's account.

YouTube and Google

Under the YouTube API Services Developer Policies, relevant YouTube data stored by ChannelCockpit must be deleted as soon as possible and within seven calendar days after a ChannelCockpit storage-deletion request, in-app authorization revocation or ChannelCockpit account deletion. After revocation through Google's security settings, the policy sets a 30 calendar day outer deletion ceiling for related stored API data. Other non-statistical API data must generally be refreshed or deleted within 30 calendar days. For authorized statistics retained longer, the policy requires the API client to verify authorization at least every 30 days.

These are official obligations and outer policy ceilings for YouTube data stored by ChannelCockpit, not a promise to wait that long and not a provider-deletion guarantee. ChannelCockpit applies the applicable authorization and retained-data controls to its own stored YouTube data. Explicit Disconnect and authenticated account deletion use the provider-revocation boundary and local cleanup described here. Deleting ChannelCockpit data does not delete data held by YouTube. Use a YouTube or Google control that supports deletion for data held there.

TikTok

ChannelCockpit uses TikTok's documented token-revocation endpoint when it can revoke a connection. Revocation remains best effort. For data held by TikTok, use TikTok's privacy request or TikTok's account controls. ChannelCockpit does not promise a TikTok-side deletion period.

Instagram and Facebook

A signed Meta data-deletion callback is connection-specific: it requests removal of the matching local Facebook or Instagram connection data and does not delete your ChannelCockpit account. A separate verified ChannelCockpit request is needed for full account deletion.

The callback response uses an opaque confirmation code and status URL. The public status receipt retains only the platform, completion status and time plus a hash of that opaque code for 90 days; it does not expose a provider user identifier. For data held by Instagram or Facebook, use Meta's account or privacy controls described in the Meta Privacy Policy.

Privacy-rights requests

The rights below are subject to the conditions and exceptions in Regulation (EU) 2016/679. The authenticated export, Disconnect and account-deletion controls are specific product actions; they do not replace a complete privacy-rights process.

Articles 15, 17, 19 and 20 GDPR cover access to personal data and processing information, erasure where a ground applies, recipient notification and portability where its conditions apply. Article 19 requires notice of relevant erasure to recipients unless that is impossible or involves disproportionate effort and, on request, information about those recipients. Erasure can be limited where continued processing is required by law or necessary to establish, exercise or defend legal claims. Rights and copies must also respect other people's rights and freedoms.

ChannelCockpit responds to a rights request without undue delay and in any event within one month after receipt. Where the complexity or number of requests makes it necessary, that period can be extended by two further months. ChannelCockpit will tell the requester within the first month about an extension and its reasons. If no action is taken, ChannelCockpit will explain the reasons and the right to make a complaint and seek a judicial remedy without delay and at the latest within one month after receipt.

Rights communications and action are provided free of charge. A reasonable fee or refusal is possible only for a manifestly unfounded or excessive request where the legal conditions are met. Where there are reasonable doubts about identity, ChannelCockpit may request only the additional information necessary to confirm it. A complaint can be made to a competent supervisory authority without contacting ChannelCockpit first; the Privacy Policy identifies the current controller contact and complaint route.

Controller and processor requests

For data ChannelCockpit controls for its own purposes, Amed Bozo receives and decides the request under applicable law. Requests can also be sent to support@channelcockpit.app; this is the same monitored contact identified above.

Where ChannelCockpit processes personal data on behalf of another controller, the relevant controller remains the decision owner. Under an activated Data Processing Addendum, ChannelCockpit follows that controller's documented instructions and assists through the rights path. A direct request from a data subject is acknowledged and forwarded to the relevant controller unless ChannelCockpit is authorized to respond; it does not let ChannelCockpit override the controller's lawful decision.

Special-category personal data is prohibited in the current service. The Privacy Policy explains processing, retention, recipients and complaint routes; the Terms of Service explains the account relationship; and the Data Processing Addendum governs activated processor-scope handling.