What happens to my data when I delete my Valid Email Checker account?

When you click Delete Account in Account Settings and confirm the destructive prompt, Valid Email Checker calls the delete-account edge function, which in turn invokes the delete_user_account RPC under your JWT. The RPC walks the database in a fixed order and removes everything tied to your user_id. There is no soft-delete flag on most tables — rows are physically removed in the same transaction.

What gets deleted immediately

• Auth record. Your row in auth.users is removed, taking your email, password hash, and any OAuth identity with it. The email is freed up — you (or anyone else) can sign up with it again from scratch.
• Profile and metadata. users_metadata, first_name, last_name, avatar, marketing preferences, notification settings.
• Credits and balances. Pay-As-You-Go and Monthly buckets are zeroed, credit-history rows are dropped, auto-refill configuration is removed.
• Sessions and devices. user_sessions and login_history rows for your account.
• 2FA settings. TOTP secrets, backup codes, email 2FA settings — all removed from user_2fa_settings.
• API keys. Any keys you generated under Developer settings are revoked and the rows removed. Bulk jobs running against them stop returning data on the next request.
• Integrations. Connected Mailchimp/HubSpot/Klaviyo/etc credentials and any sync configuration are removed.
• Team membership. If you owned a team, members are removed. If you were a member of a team owned by someone else, that membership is removed (the owner sees you disappear from their members list).

What is queued for delayed purge

Verification results — the per-address rows from your single and bulk verifications, plus any uploaded CSV files in storage — are marked for cleanup rather than dropped synchronously. This is partly performance (a single account can have millions of result rows) and partly so the GDPR-cleanup job can also process the storage bucket in batches. The results-deletion timer is governed by the data_retention_days setting in system_settings (default 15 days). After that window passes, the perform_gdpr_cleanup_all RPC purges the rows and the storage files in batched runs — covered in detail under how long after delete is my data really gone.

Confirmation email

After the RPC completes, the delete-account function calls send-email to dispatch an account_deleted notification to the email that just got removed from auth.users. It is a confirmation receipt — you asked to be deleted, here is the timestamp it happened. If your email provider delays it past the deletion, that is fine; the action is already complete on our side.