Account Deletion: What Apple and Google Require

Do apps have to let people delete their account?

Yes. If your app lets people create an account, Apple requires that they can start account deletion from inside the app, and Google Play requires an in-app path and a web link where people can request deletion without reinstalling the app. Deactivating or hiding the account is not enough.

What to build

1. A clear Delete account option, usually in settings or profile.
2. A confirmation step explaining what will be deleted.
3. Deletion of the account and associated personal data on your backend (some records may be kept where the law requires).
4. For Google Play, a public web page where people can request deletion.

Common review problems

• The option only sends an email to support.
• Deletion requires calling or visiting a website on iOS.
• The account is signed out but not deleted.

Deleting the login is not the whole task

An account can have profile information, uploaded files, private notes, shared records and subscriptions. Decide what should happen to each. Removing the authentication user while leaving personal files publicly accessible does not complete the intended deletion.

Some information may need retention for legal or operational reasons. Explain those exceptions and their duration where applicable. Do not describe temporary deactivation as permanent deletion.

Make the path understandable

Use a clearly named option in account settings. Explain the consequences before the final confirmation, including whether the action can be reversed. Reauthentication can help protect a sensitive action, but should not turn into an unnecessary barrier.

If the process takes time, explain what has been requested and how completion will be communicated. Only say the account is deleted when the relevant process has actually completed.

Apple and Google have distinct requirements

Apple expects an in-app way to initiate deletion for apps that support account creation, subject to its policy details. Google also requires an external web resource for deletion requests in the applicable account-creation case.

A web resource should clearly identify the app or developer and explain how to request deletion. It should not force someone to reinstall an app they have already removed. A generic support homepage with no deletion instructions can be hard to use and may not satisfy the requirement.

Include connected services

If a person signed in with an external provider, handle the relevant provider requirements. Consider tokens, active sessions and files associated with the account. Account removal and session invalidation are not always the same backend operation.

For paid subscriptions, explain how cancellation is handled. Deleting a profile does not automatically guarantee that a store subscription has stopped renewing. Give the person the appropriate route and test the actual behavior.

Test with a disposable account

1. Create a sample account and private record.
2. Upload a harmless sample file if the app supports files.
3. Start deletion from the app.
4. Confirm the account cannot access protected information afterward.
5. Check the intended treatment of records and files.
6. Test the external request route required for Google Play.

Use a test environment when possible. Do not run destructive checks on a customer's account.

Keep public information aligned

The app, privacy policy and store declarations should describe the same process. If the policy says users can delete their data from Settings, the control should exist and work in the released build.

Record the steps for support staff too. Someone requesting help should not receive contradictory instructions or be told to email a different address after following the published process.

Can I keep anonymous statistics?

It depends on how the information is transformed and what obligations apply. Removing a visible name is not necessarily effective anonymization. Define the retained data and explain the practice accurately rather than making a blanket promise.

Can deletion be requested through support?

A support route may be part of a permitted process in some cases, but do not assume an email address alone satisfies the in-app and external paths required for your app. Check the store-specific rule and implement a clear journey.

What about shared records?

A deleted member may have contributed to a shared booking or discussion. Decide what is removed, anonymized or retained and why. Preserve other people's legitimate records without leaving unnecessary personal information exposed.

Should I delete a production account to test it?

Use a disposable sample account with harmless data, preferably in a test environment. The test needs associated records and files so it exercises more than logout. Never use a customer's account without the appropriate request and process.

What should the final message say?

Match the actual outcome. If the request is pending, say it was received and explain the next step. If deletion completed, confirm that state and any relevant retention exceptions. Do not use a success animation to conceal an operation that has not finished on the backend.

Check the public instructions

Ask someone unfamiliar with the app to find the deletion route from the published explanation. A technically available control is still difficult to use if the instructions name the wrong menu or require access the person no longer has.

Questions people also ask

Does this apply if sign-in is optional?

If people can create an account in the app, the requirement applies.

Can I keep some data after deletion?

You may need to keep some records, such as for legal or financial reasons. Explain this in your privacy policy.

Build it with RNBlocks

Ask our agent in RNBlocks for the account-deletion journey your app needs, including associated data and the relevant store path. Test it with a disposable account. Continue with the publishing workspace to keep the app behavior and release information aligned.