What stays when you delete your account
Since 24 May, a XNeuronal account can be deleted from inside the app, in two taps. The server checks that it really is you, then erases the account and everything attached to it: memories, links, conversations, reminders, settings. The same morning, the big clear-out in the settings stopped leaving orphaned reminders in the bell and conversation transcripts with no owner.
Edith's Sundays
Helen has lunch at her mother's almost every Sunday. Edith is eighty-six, has a kitchen that smells of coffee from eleven o'clock, and a way of telling stories that takes the long road round. You start with the walnut cake, pass through Aunt Mabel who made it "with far too much butter", reach the year the house was bought, and come back to the cake without anyone having written down how much sugar goes in.
Since the spring, Helen has had a habit. In the car, before she starts the engine, she presses the button and repeats what she remembers. "Mum's walnut cake: two hundred grams of walnuts, no baking powder, low oven. Aunt Mabel is Grandad's sister, she lived in Leicester. The house was bought in 1968, with the money from selling the van." The sentences come out of order, and the app sorts them: a recipe, a person, a piece of family history.
It was her son Jamie who installed the app for her, and it was Jamie who asked the question one evening, looking at the constellation of memories on the home screen. "And if one day you want to stop, where does all that go? Does it stay with them?"
The question is less technical than it sounds. It holds three. What can you erase, and is it really erased? What stays when you leave? And what Edith tells, who does that belong to?
Before 24 May: no way out
Until the morning of 24 May, the honest answer to Jamie would have been awkward. The app knew how to erase memories: one card at a time, from its little menu, or in batches from the settings. But an account, once created, could not be deleted from inside the app. There was no button, and no route on the server to do it.
For an app whose whole offer is to hold what you don't want to lose, that is a fundamental gap. A memory only earns trust if you know how to close it. People tell a notebook their mother's recipes, their cousins' names and the story of the house more readily when they know they could burn it, than a notebook whose last page they have never seen.
That morning, before adding the way out, a door that already existed and didn't shut properly had to be fixed.
The clear-out that left traces
The big clear-out lives in the settings, in the Memory section. You choose what to erase, by family (events, reminders, alarms, tasks, memos, conversations), and how far to go: what is past, what has been completed, or everything. It is the tool for people who want to make room without losing it all: past appointments, finished tasks, old conversations.
On the morning of 24 May, a clear-out left two awkward remains behind.
The first showed on the home screen. The erased memories were gone from the server, but the constellation kept displaying them. The reason lay in how the app learns that a card has disappeared. When you delete a card by hand, a signal goes out with its identifier, and the screen removes it. The clear-out used a different route on the server, one that erases in one go, and no signal went out. So the screen believed nothing had changed. Since 10:25 that day, a "memory has just been cleared" signal goes out after every successful clear-out, and the home screen reloads everything.
The second showed in the bell, the list of notifications. It still displayed reminders that had come due and morning briefings pointing at cards that no longer existed. And the little red counter stayed lit. The server now deletes, in the same move, every notification whose cards have all gone. A morning briefing that mentioned three appointments stays as long as one of them is still alive. And the counter drops straight away, instead of waiting for the next minute.
Conversations that outlived their summary
Twenty minutes later, a real clear-out brought out a quieter remain, and a more important one.
When a conversation ends, the app keeps two things from it. A memory of the conversation type, with a summary, used to find "what we were talking about last time". And, separately, the full transcript of the exchange. Clearing conversations erased the summary and forgot the transcript. From Helen's point of view, the conversation had vanished from the list. On the server, the full text stayed there, with no memory leading to it, forever.
It is the worst kind of defect for a delete function, because it is invisible. Nothing in the app showed that text, so nothing signalled that it was still there.
The fix at 10:44 changed the method, not just the scope. Instead of looking for what depended on the memories erased a moment ago, the server now looks at what is still alive for the owner, then deletes every notification and every transcript that points to nothing alive. The difference matters: remains left by older clear-outs, done before this fix, go too at the next clear-out. A deletion is only worth something if it also catches the ones that missed.
The button of 24 May
Two minutes later, at 10:46, the button arrived.
It sits in the Account screen, opened from the settings, below "Change my password" and "Sign out", in red. Tapping it opens a confirmation that makes no attempt to hold you back: "Delete your account? This action is permanent. All your neurons, conversations, reminders, and preferences will be erased. The account cannot be restored." No survey about why you are leaving, no mandatory cooling-off period, no email to confirm.
The choice to add nothing is debatable, and it was made knowingly. Many services keep an account "asleep" for a few weeks, in case you change your mind. That reassures whoever tapped too fast, and it is also a way of keeping data you asked to have erased. Here, the confirmation does the job of the undo: it spells out what is about to go, and that nothing will come back. Once you have said yes, the server does not keep a copy aside in the meantime.
Behind the confirmation, three things happen, in this order.
First, the phone unregisters from notifications. It isn't strictly needed, since the next step will erase that registration anyway, but it is cleaner: between the request and the full erasure, no reminder should try to ring for an account that is disappearing.
Next, the phone calls the server with the person's proof of sign-in. The server checks that proof itself and accepts nothing else: no identifier passed as a parameter, no deleting someone else's account. If the session has expired, the app asks you to sign in again before deleting. Then the server deletes the account.
Finally, the app closes the session on the phone, and the screen switches at once to the no-account view, as on first launch.
One deletion, and everything attached to it
The most important point can't be seen in the app. Deleting the account is not a list of tables to empty one by one, where forgetting one would be enough to leave something behind. In the database, a person's data carries their account identifier, and the database knows it must disappear with the account. Deleting the account is enough: memories, the links between them, the log of their changes, the rules given to the assistant, conversations and their transcripts, the bell, notification registrations and settings all go together.
It is exactly the lesson of the morning's two fixes, taken the other way round. The clear-out left remains because it followed references by hand. Deleting the account follows none: it relies on the one thing all this data has in common, its owner.
And the no-account mode? That day, it didn't get a button. In anonymous mode, memories are tied only to the device, and the reasoning on 24 May was simple: there is no account to delete, there is an app to uninstall. Today the rule is written on the server side: an anonymous install left unused for thirty days is erased overnight, and the app gives warning during the last ten days.
An app to keep family memories, and really erase them?
That is roughly the question someone asks when they hesitate to trust a phone with what their mother tells them. The answer comes in two parts, and the privacy and accounts page sums them up.
You can start without an account, which is enough to try it out. But a memory tied to a single phone disappears with it, which is why an account is worth having as soon as you put things that matter into it. The account locks nothing in: you delete it from inside the app, and the steps are also set out on the website, including how to ask for it by email.
In between, there is the partial clear-out. Helen can erase last year's appointments at the garage without touching Edith's recipes. The two gestures don't look alike, and that is deliberate: the clear-out chooses what goes, deleting the account chooses nothing.
What belongs to whom, since then
The answer to Jamie became more precise after 24 May, as the app learned to talk to other people.
On 5 June, deletion got a record. Before erasing, the server writes one line proving that a deletion took place: a fingerprint that cannot be traced back to the account, the date, and the list of what was purged. No readable personal data. It erases itself after five years. And if the person had given feedback on the app, the email address attached to that feedback is removed before the deletion: the feedback stays, anonymous.
Pictures don't live in the same tables as memories, and the database can't reach them. Since 27 July, the profile photo is removed explicitly at the moment of deletion. Card images are removed by a nightly sweep, which deletes every image that no card points to any more.
Then sharing arrived, and with it the real family question. A card can be shared with someone close in two ways, and they don't survive a departure in the same way.
A card shared in collaborative mode remains the card of the person who created it. Helen and her sister Brenda tick the same list, but the list is Helen's. If Helen deletes her account, her list goes with it, and the share stops.
A given card, the mode where everyone ticks for themselves, becomes the recipient's card from the moment it is sent. It is no longer linked to the original, it is theirs, with its picture and its attachments copied. If Helen gives the walnut cake recipe to Jamie, then one day deletes her account, the recipe stays in Jamie's memory. It no longer depends on his mother's.
Messages exchanged between friends inside the app, on the other hand, are erased on both sides along with the account of whoever leaves.
What Helen did
Helen didn't delete her account. But Jamie's question changed the way she files things.
What comes from Edith, the recipes, the names on the wedding photo, the story of the house, she no longer keeps just for herself. She gave the walnut cake recipe to Jamie and to Brenda, by saying so, and each of them now has their own card. When Brenda adds that it needs "a drop of rum, Mum never says so", she writes it in hers. What gets passed on no longer hangs on a single phone or a single account.
And what concerns only her, appointments, shopping, everyday notes, stays in her own memory, with a door she knows where to find.
She also did a bit of clearing out, the real kind, the kind that chooses. Last winter's conversations, when she was looking for a plumber and comparing quotes, went in one gesture. Past reminders too. Nothing Edith had told moved, because none of it was a conversation or a reminder: they were memories filed away, a recipe, a person, a piece of history. And the bell, this time, didn't show her reminders pointing at erased cards.
Jamie asked one last, more practical question: what if he is the one who leaves the app one day? The recipe stays his as long as he keeps his account, and goes with his account if he deletes it. His mother's copy doesn't move. Each their own memory, each their own door.
That may be the most useful thing 24 May changed. Not the button itself, which we hope will rarely be used, but the answer you can now give to Jamie's question. What you keep for yourself really gets erased when you decide so. What you want to pass on, you give, and then it belongs to the people who receive it.
If you want to know how the app chooses what to keep before anyone asks it to erase anything, that is another story.