How-to

Getting your data out, and deleting it

Both are buttons in your account menu. One is complete and costs nothing; the other happens immediately and cannot be undone.

Export: one file, no waiting

Account menu → Data → Download everything. The archive is built in your browser and comes down as a single .zip. There is no request to file, no queue, and no email to wait for.

your-export.zip
├── lexicon/          your entries as Markdown, one file per node,
│                     one folder per lens — the same layout a vault has
├── data.json         every row verbatim: cards, review schedules,
│                     grants, facets, links, relationships
├── attachments/      your uploaded files, filed by entry slug
└── README.md         what this is, and how to get it back in

It is complete twice over, on purpose. The markdown tree is the human artifact — you can read it in any editor, grep it, put it in git, or push it straight back with npm run sync. But markdown has nowhere sensible to put an SM-2 interval or a per-lens sharing grant, so rather than invent frontmatter for those, the sidecar carries every row exactly as stored.

Your review history is in there — the schedules, not just the cards. If you re-import elsewhere, the years of spaced repetition you have accumulated survive the move. That is the part an export usually loses.

If something could not be included

Rows are all-or-nothing: if a table cannot be read, the export fails rather than handing you a plausible-looking archive that is quietly missing something. Attachment files are best-effort — one unreadable upload should not cost you six hundred entries — and any that could not be fetched are named in the README.md. An incomplete archive never claims to be complete.

Export versus a vault

	What it is
Export	A snapshot of everything, including the account data a file cannot hold. One click, no setup, no ongoing relationship.
A vault	A living copy of your notes on your own disk, kept current by sync. Needs a terminal to set up. Working with files.

They are not alternatives. A vault is the better daily habit; an export is the thing to take before anything irreversible.

Deletion

Deleting your account is immediate and irreversible. There is no grace period, no soft-delete, no scheduled purge to interrupt, and nothing to restore from. It destroys your entries, links, lenses, facets, cards, review history, uploaded files, friendships and follows. Export first.

Account menu → Data → Delete my account. When you confirm, the account row goes and everything keyed to it cascades behind it in the same moment. Nobody at this end can put it back, because there is nothing left to put back.

What confirmation asks for, and why

You will be asked for two things:

Your handle, typed out. Not clicked — typed. It is trimmed and case-folded and it tolerates a leading @, because the point is deliberate intent rather than typing precision.
Proof you are here now. Your password if you have one; if you signed up with Google, a fresh sign-in instead.

That second one is the part worth explaining, because it looks like friction and is not. A valid session is not consent: sessions last weeks, survive a closed laptop, and are exactly what an unattended machine hands to whoever sits down next. Being signed in proves somebody signed in once. It does not prove you are the person clicking.

If you have never set a handle, you will be asked to set one before deleting. It is what the confirmation matches against. Your handle.

The one window where something survives

Database backups are kept for 30 days and are not individually editable, so deleted content may persist inside one for that window before it ages out. Nobody restores from it on your behalf and nothing reaches back into your account; it simply expires.

Error reports are held by the error-reporting service for 30 days and then deleted by them. They carry no entry content, so there is nothing of yours in them to remove.

What does not survive

Including one thing many services keep: the record of which version of the terms you agreed to, and when. That goes with the account. Keeping proof of consent after erasing the person who gave it would make “irreversible” a smaller word than it sounds.

Leaving without deleting

Worth saying, because deletion is often not what somebody actually wants. If the goal is to stop using the app rather than to erase it, take an export and sign out. Nothing is charged, nothing expires, and the palace is there if you come back.

If you had a hosted subscription and it ends, the palace freezes rather than emptying: everything stays readable, reviewable and exportable, and writing resumes if you come back. Nothing is deleted by not paying. My palace stopped saving.

Deletion is for when you want it gone. Those are different requirements and only one of them cannot be undone.

What leaves this app, and what never does — what is stored and sent while the account is alive.
My palace stopped saving — what a lapsed subscription does, and what it never touches.
Working with files — a copy that stays current instead of a snapshot.
Privacy policy and Terms — the same commitments, in the register that binds us.