Data deletion & retention

The three windows

• Active: your member record exists, you can send, your domain reputation accrues.
• Cooldown (14 days): you've hit /account/settings/delete. SMTP AUTH is blocked, so no new mail goes out. The record is still intact; reactivating clears the deletion and restores sending. A reminder email goes out 7 days before cooldown ends.
• Hard-delete + export window (30 days): cooldown expired. The member row and domain ownership pointers (including DKIM private keys + API key hashes) are deleted outright. Cross-table rows we must keep (suppressions, bounce history, OAuth sign-in audit) have your DID rewritten to a deterministic anon:<hash> value so they no longer point back at you. A deletion_export_token remains valid for 30 days so the export link in your deletion-executed email keeps working.

After day 30 post-hard-delete, the export token expires, the contact email field is purged, and we hold nothing addressable to you beyond what was already on its own retention clock under the main retention schedule.

Changing your mind during cooldown

Sign in during the 14-day cooldown and click Reactivate on the banner at /account/settings. Sending resumes immediately; the deletion timestamps clear. The reactivate link in the deletion-scheduled email does the same thing without requiring a session.

Past the cooldown there is no reactivation. Hard-delete is irreversible: we cannot reconstruct deleted rows, and the verified-mail-operator label on your DID is revoked by the labeler.

What we delete, what we anonymize, what we keep

What's in your export

A JSON archive at /account/settings/data-export containing every field linked to your DID at the moment of request: member row, all enrolled domains, all suppression entries, deletion lifecycle row (if one exists). Downloadable during the active state, during cooldown, and for 30 days after hard-delete via the tokenized link in the deletion-executed email.

If a field isn't in the export, we don't hold it about you.

The reasoning

14 days is long enough that an accidental click is reversible and short enough that an adversary who got into your account can't drag out a forced deletion. A reminder email at day 7 reduces silent-loss risk.

30 days post-hard-delete for the export token means a recipient who archives the deletion-executed email can still pull their data if they didn't grab it during cooldown. The token is single-purpose: it authenticates the export endpoint and nothing else.

12-month audit rows hold the anonymized DID and the deletion timestamps. No contact info, no handle. That's enough to answer regulator and abuse-investigation questions about deletion volume and timing without retaining an addressable identifier for the deleted member.

If you can't reach the dashboard

Lost handle, atproto identity rotated, or otherwise can't sign in: email postmaster@atmos.email from a mailbox you can prove control of, or sign the request with your DID's signing key. We verify and process within 14 days, then the same lifecycle above applies.

Questions

Atmosphere Mail LLC, postmaster@atmos.email