Delete your Dogoos account

Four controls, four blast radii. The top two only hide: nothing leaves the server, and a hidden read still counted against the day it was taken. Clearing reads and photos really does empty both the phone and the server, and still leaves your dogs, your bones and your sign-in exactly where they were. Only the fourth takes the account, and it's the only one you can't walk back.

Reads are append-only by design — the app can add one but never quietly rewrite one, which is part of what makes a mood history worth showing a vet. It also means your phone can't delete them. Erasure is a server job for that reason: it reaches the read archive and the private file storage no app is allowed to touch.

A household is up to five accounts sharing one set of dogs, one mood history, one album and one health journal — joined by an invite code that works once and dies after 24 hours. When somebody erases their account while the rest carry on, the rule is short: everything that was about you goes, and everything that was about the dog stays.

Your personal account is erased in full. You leave the household, and if you happened to be its owner, ownership passes to a remaining member on the spot — a household is never allowed to be ownerless. The keepsake photos you captured are deleted from the shared album. The reads you took keep their mood, their confidence and the cues the AI spotted, because that's the family's record of their dog, but your name comes off them: they show as taken by a former member. Health journal entries you added are re-attributed the same way, and any live invite code is destroyed.

If you were the last member there's nobody to leave anything for, so the household, its shared dogs, its album files and its invite codes are deleted along with your account. That is the one way deleting your account takes a family's dogs with it — and by then there's no family left to take them from.

One gap is worth knowing. If you simply leave a household rather than erasing your account, what you shared into it stays with the family still using it. Want the photos and reads you captured taken out after you've already left? Email support@dogoos.com and ask — it isn't a button in the app.

“Deleted” ought to mean deleted, and for your content it does. What outlives it is a backup window, a tombstone that catches late uploads, some expiring AI bookkeeping, one purchase row with your name cut out of it, and the ledgers any business has to keep. Days, not years, for everything we control — here is each one.

Backups, up to seven days. Point-in-time recovery can hold deleted database records for up to seven days, and soft deletion can hold deleted private files for the same, before both age out on their own.

A deletion safety record, eight days. A file upload that began before you deleted can still land afterwards. Dogoos keeps a server-only marker, removes any stray file when it appears, and re-scans for eight days before retiring the marker. A direct file link obtained earlier may work until that sweep runs.

Short-lived AI records, thirty days. Operation and recovery-cache records from the AI pipeline expire by themselves after thirty days.

A Play purchase record, with your name taken off it. The row stays so one receipt can never be replayed onto somebody else's account, and so a live subscription, refund or dispute can still be settled — but your account identifier is removed from it during erasure.

Cost totals and logs, on their own clocks. Aggregated, non-content AI cost totals are kept for financial reconciliation, and legal, security and provider logs keep the retention periods they came with. The privacy policy is the binding version of all of this.

Settings → Privacy & data → Data & personalisation → Download my data builds one JSON file — your profile, every dog, every read with the record it came from, your cached stories, redemptions, training and quiz results, bookmarks, themes, preferences and your email choices — and hands it to you through the share sheet. Mail it to yourself, or drop it in Drive; dismiss that sheet and nothing has been saved anywhere. On the web app it goes straight to your downloads instead. Either way it carries a flag saying whether the full read archive was retrieved, so a partial export announces itself instead of quietly looking complete.

Two things are deliberately not in it: the server-only consent and delivery audit records, and anything usable as a live unsubscribe token. Ask support@dogoos.com for the broader access request if you want those too — and ask before you delete, because afterwards there's no account left to match you to.