Our delete all my data button leaves one table alone, and the dialog says so

The app contains two controls promised in the privacy policy: export everything and delete everything. Both are straightforward decisions, but the exclusion in the delete function is more complex. During export, seven tables are assembled into a single JSON document and returned as a download. Personal data, such as onboarding answers, is included to ensure the export is truly complete. The onboarding answers also include a deletion date, acknowledging the retention promise that the user accepts.

The delete function first performs a bulk delete operation and then issues four separate statements for other tables. This pipelining approach reduces network round trips and simplifies reasoning about concurrency, despite being initially perceived as a concurrency bug. The exclusion is that exercise attempts are not deleted by this control, as they are counted towards the AI scoring budget and must be retained. This decision prioritizes metering over deletion, ensuring that customers cannot easily reset paid features.

The deletion control also has an interesting trade-off. While it deletes certain data, it retains a marker indicating whether a review was requested, resetting the account to a state where the review prompt can appear again. This is considered a design choice, as suppressing repeat asks is the responsibility of the component rendering the prompt, not the deletion endpoint.

The policy explicitly states that assessment centre exercise attempts, including written answers and AI feedback, are retained until the account is deleted to enforce usage limits. They are removed immediately upon account deletion, as keeping this data would violate the principle of not retaining data unnecessarily. The deletion endpoint does not make product decisions, and its existence helps maintain the exclusion list in the privacy policy.