Account & Data Deletion

There are two ways to delete your Stublet account and your personal data:

Recommended path — in-app (immediate):

• Open the app and sign in
• Go to "Settings" > "Account" > "Delete account"
• Confirm. Deletion happens immediately and cannot be undone

Email path — for users who can't sign in:

• Email [email protected]
• Subject: "Account deletion request"
• Include the phone number or email associated with the account, plus a brief detail that helps verify you're the account owner
• We respond within 30 days, as required by Israel's Privacy Protection Law

Account deletion runs the following operations on our servers (a soft delete):

On your user record:

• Name, phone number, email address, and profile photo are nulled
• A deletedAt marker with the deletion timestamp is added
• All push notification tokens (FCM) are removed
• All your Firebase refresh tokens are revoked — every active session is terminated immediately

On your listings:

• Every listing you posted moves to inactive (isActive = false) and leaves the public feed
• Your name and photo as the listing's host are nulled, so the listing won't expose you even if an internal user finds it in archives

In the social graph (Neo4j):

• Your node and its edges (FOLLOWS, FRIENDS_WITH, BLOCKS) are deleted
• People who followed you no longer see you in their followers list

For other data:

• Saved listings — deleted
• Notification history — soft-deleted
• Interactions (views, likes, seen flags) — deleted
• Reports you filed about other users — deleted
• Your profile photos and listing photos in Cloudflare R2 storage — deleted from storage

Deleting an account does not erase every trace of you. Some data is kept for legitimate reasons:

• Booking requests you sent or received are kept without your identifying information — so the other party in the deal retains a record of what was agreed
• Reports filed against you (not by you) are kept for safety, ban-evasion prevention, and to handle later appeals
• Messages you sent in the chat are soft-deleted on your side, but the other party in the conversation still sees the conversation history on their side — Stublet does not delete content from a third party without their consent
• Aggregate analytics events that don't identify you personally (e.g. "listing viewed") are kept to improve the service
• Data subject to an active legal hold, if one applies

We do NOT keep financial data on you, because Stublet does not process payments and we have no tax records tied to you.

Stublet uses third-party providers that have their own retention windows. We can't control theirs, but here's the picture:

• Firebase Authentication: all of your refresh tokens are revoked immediately and every active session ends — the account stops being usable at that moment. The underlying identity record at Firebase (the one holding the phone number or email address you signed in with) is not erased in that same instant: it is retained so we can restore the account if it was deleted by mistake and you re-register with the same number. Final erasure of that identity record happens later, through an internal scheduled process, not as part of the deletion action itself. If you want the identity record erased immediately rather than waiting for that process, email us at [email protected] and we'll do it manually
• Firebase Cloud Messaging: your token is removed. Push notifications already sent to your device sit there until you delete them
• Firebase Analytics and Crashlytics: keep data per their own policy (typically 14 months), without linking it to your personal identifier after deletion
• Sentry: error logs persist up to 90 days and contain only stack traces — no personal data
• Cloudflare R2: your photos are deleted from storage. Cloudflare's internal backups may keep a copy for up to 30 days

If you want to request deletion directly from a provider, reach out via the links on our subprocessors page.

If you signed up to Stublet via Facebook, deleting your Stublet account removes our link to your Facebook account on our server side, but doesn't change anything on Facebook's side.

To make sure Facebook also forgets the permissions you granted to Stublet:

• Facebook on desktop: log in → Settings & privacy → Settings → Apps and websites
• Facebook on mobile: menu (☰) → Settings & privacy → Settings → Apps and websites
• Find "Stublet" in the list and tap "Remove"
• Facebook will ask if you want to remove your Stublet activity that was tied to Facebook — confirm

In-app path: the deletion job runs in full within seconds. The photo-deletion step in cloud storage may take a few more minutes.

Email path: up to 30 days from receipt of your request (the legal window). In practice we move as fast as we can — typically 1–3 business days.

After deletion runs, your fields are nulled in the database within that same operation. Automated backups taken before the deletion are kept up to 30 days and then rotate out, so a minimal trace of you may remain until all backups have rotated.

Question before deleting? Issue during deletion? Reach out:

Email: [email protected]

Under Israel's Privacy Protection Law, 5741-1981, you also have the right to contact the Privacy Protection Authority at the Ministry of Justice (22 Kanfei Nesharim St., Jerusalem) if you're not satisfied with how we handled your deletion request.