Deleting your data

01 What it does

• The handle is barred permanently. Nobody can send a note to it again, and any attempt is refused.
• Every note sent to it or from it is erased, and so is every mutual it was part of.
• Every letter written to it comes off the wall, and the name can never be written to again.
• Everything the handle itself wrote is erased with it: its letters, its replies, its hearts and its likes.
• Any pings bought for it and not yet used are erased too, and they cannot be restored, because nothing is left to tie them to. Section 05 says how to have them refunded.
• Any membership, pending verification, recovery record, session, sign in link, alert address and mail waiting to go out are erased.
• Nobody is told. Not the people who had sent it notes, and not the people it had sent them to.

It takes effect at once and it does not wait on us. It works whether or not the handle has ever been used on celestual, which is the point: somebody who wants nothing to do with this product should not have to join it in order to say so.

If you have never proved a handle here, and signed in only with an email address, a school address or Google, write to contact@celestual.app from that address and we will erase the account it signs in.

02 Why it asks whose it is

The page shows a short code. Send it to our Instagram account from the account you are taking off, and the button appears the moment the message lands. It is the same proof the rest of the product uses, and it still needs no account here.

It asks because this erasure is not only yours. Taking a handle off also deletes notes other people sent and takes down letters other people wrote, and for a while anybody could type any handle into this page. The refusal says nothing about whether a handle was ever on the books, so the page cannot be used to find out who is here.

03 One letter, or the whole name

The button above takes the whole name off everything. For a single letter about you, there are smaller acts, and they cost nothing:

• Remove it. Once you have proved the handle a letter is written to is yours, you can remove that letter from the wall in one tap, and undo it within a day. The mail that tells you somebody wrote you a letter carries the same removal as a link.
• Report it. Anybody signed in can report a letter, on the letter. It comes off the wall on the tap, before anybody reviews it, and a person at the desk can put it back if the report turns out to be wrong. Nothing is destroyed.
• Every letter, and nothing else. The wall has its own takedown for a whole name, from a proved handle, if you want the letters gone without leaving the product.

A letter also comes off by itself after thirty days, and a note that is not mutual lapses at its Saturday reveal and is deleted a week later. Neither needs a request.

04 What we keep

• The bar itself, as a salted hash of the handle, because a permanent refusal we forget is not permanent. It holds nothing else and cannot be turned back into a handle.
• The letters other people wrote to the handle. They come off the wall and are held out of sight rather than destroyed, still filed under the handle, because they belong to the people who wrote them and a decision about one may need to be looked at again. No desk can put one back up for a handle that has left.
• The record of each purchase of pings made for the handle, with the handle taken off it: how many pings, the amount, the currency, when, and Stripe's references for the payment. Tax and accounting law require us to keep the payment. They do not require the person.
• The public profile we looked up for the handle, its display name, badge and picture, stays in our lookup cache until you ask us to drop it. Write to us and we will.
• An email address that pressed stop on a kind of mail stays on the stop list, so that nothing of that kind is sent to it again.
• Deleted rows can sit in an encrypted backup for a short period before it is overwritten.

05 Pings you bought

Bought pings belong to the handle they were bought for, so taking it off gives up any that are still unused, and they cannot be restored afterwards. If you want them refunded, ask before you take the handle off: unused pings are refunded if you ask within fourteen days of buying them, as the terms say.

If you have already taken it off, write to us anyway, within those fourteen days. Our side no longer knows who bought what, but Stripe still holds the payment. We can find it by the card or the email address you paid with, and refund the pings that were unused.

A refund never touches a note. The notes a handle sent are erased with it, whatever they cost.

06 If you change your mind

The bar can be lifted, so the handle can be used again. What was erased stays erased, because there is no copy anywhere to restore. Write to contact@celestual.app from an address we can connect to the account, or send a direct message from the handle itself. We answer within thirty days, and the privacy policy says what is stored and why.