Delete ToCast data

In the app or outside it

1. Open Settings → Delete my ToCast data. Guest installations use their existing session; a saved account verifies its immutable email with a deletion-purpose code.
2. Preparation does not delete data. Save the protected recovery proof and exact operation key before separately confirming irreversible deletion.
3. Wait for server-confirmed completion, then acknowledge receiving that result. An accepted request is not completion.

Without the app, use the separate saved-account deletion page. It verifies email ownership without creating a product session and remains available to blocked accounts. This information page has no form, script or cookies. If your mailbox is inaccessible, or a guest session was lost, contact support; a lost guest identity may not be recoverable.

Lost responses and unknown outcomes

Side-effect-free preparation can be retried. The exact saved deletion-only proof and key recover accepted deletion after refresh or session expiry, without another code. Never log out, reinstall or clear storage as a recovery method. Never email the key, proof, OTP or tokens. If verification had an unknown native outcome, request a fresh code for the same operation; no rights are inferred from an identity lookup.

Pending or running is not completed. Unknown native operations keep deletion pending until an operator explicitly attests quiescence or Core restart and authoritative cleanup. Timeouts, lease age, missing browser data or an expired proof never establish completion. Support can explain a safe next step but cannot bypass ownership verification.

Deleted and retained data

Deletion removes email identity, all sessions, subscriptions and private feed secrets, owner content and generated audio, push registrations, premium grants and account diagnostics. Minimal receipts remain for recovery; administrator audit loses its owner linkage. Unlinked anonymous telemetry expires under its own retention and cannot be promised to be located by account. Local app data requires app or Android controls; uninstalling alone does not send a server deletion request.

Support correspondence, independent recipients and backups have separate handling. This revision does not verify processor/backup erasure schedules or promise instant removal from all copies. Request the actual scope from the controller.

Retention

• Guests: 180 days of confirmed inactivity.
• Saved accounts: 12 calendar months of confirmed inactivity with a warning at least 30 days before deletion. Active premium, including permanent premium, exempts the account. On expiry/revocation, an overdue account gets a new warning and at least 30 days; new activity recalculates the deadline. Unknown/failed mail delivery does not count as warning.
• Account diagnostics: 30 days; minimal administrative audit: 180 days with severed owner linkage after deletion.
• Generated audio: 14 days, independently of account lifetime.
• Completed receipt: 180 days without acknowledgement, or 180 days after acknowledgement, with an absolute cap of 365 days from completion. Deletion recovery proof is limited to 365 days and cannot grant login or data access.