In-app account deletion mechanism is present and accessible

Apple has required in-app account deletion for all apps that allow account creation since June 2022 (external apple-guideline-5.1.1). Apps that route users to an email address or external form for deletion are rejected on every submission, not just the first. Beyond the rejection risk, failing to provide in-app deletion violates GDPR Art.17 (right to erasure) and CCPA §1798.105 (right to deletion) — both of which require that deletion be initiatable by the user without unreasonable friction. 'Email us to delete your account' does not satisfy either regulation.

Add a 'Delete Account' option accessible from your settings or account management screen. The complete flow: Settings → Delete Account → confirmation dialog ('This cannot be undone') → API call → sign out + navigate to login.

For Supabase, call the deletion from a secure server-side function — never from the client with a service role key:

// Supabase Edge Function: delete-account.ts
await supabase.from('user_files').delete().eq('user_id', userId);
await supabase.from('posts').delete().eq('user_id', userId);
await supabase.from('profiles').delete().eq('id', userId);
await supabase.auth.admin.deleteUser(userId);

If a 30-day recovery window applies, inform the user clearly before they confirm. The deletion option must be navigable from within the app — no external links or support emails.