GDPR Art.17 requires that deletion requests be completed — not just acknowledged — within 30 days of a verified request. CCPA §1798.105 has the same 45-day window. Apps that soft-delete (set a deleted_at timestamp) without a scheduled hard-delete job leave personal data in the database indefinitely, making every policy claiming 'data deleted upon request' a false statement. Equally critical: third-party analytics and ad SDKs retain user data independently — if your deletion flow does not call their opt-out or data-deletion APIs, that data persists in external systems even after your database is clean.
High because a deletion mechanism that does not complete within the regulatory timeframe creates direct GDPR Art.17 and CCPA §1798.105 liability regardless of intent.
Implement deletion as a multi-step process: immediately revoke auth and sessions, queue a hard-delete job, execute within your stated timeframe. Call data deletion on all third-party services at the same time:
// Amplitude
amplitude.reset(); // Clears user ID and device ID
// For full deletion, use Amplitude's Privacy API
Keep your privacy policy's stated timeframe consistent with actual implementation — if you queue deletions, say '30 days' in the policy, not 'immediately.' Ensure your background deletion job actually runs and monitor it: a stalled queue means users who requested deletion are not being deleted, which is an active compliance failure.
app-store-privacy-data.data-handling.deletion-timeframe-compliancehighprivacy-policy.md, PRIVACY.md, docs/legal/privacy.md). Search for wording like "deleted within X days", "within 30 days", "within 90 days", "immediately deleted". Then check the backend deletion implementation: is deletion immediate (synchronous DB delete) or queued (async job, soft-delete with a scheduled hard-delete)? Look for: soft-delete patterns (deleted_at TIMESTAMPTZ, is_deleted BOOLEAN, status = 'pending_deletion' in schema files or migrations); background job schedulers that process deletions (cron jobs, queued tasks, Supabase Edge Functions triggered by a schedule); any deletion queue table (deletion_requests, pending_deletions). Flag if the privacy policy states immediate deletion but the code only soft-deletes. Flag if a long timeframe (>90 days) is used when regulations like GDPR require responses within 30 days of a verified request. Also check whether third-party services (analytics, crash reporting, ad networks) are also instructed to delete user data — look for SDK calls like Amplitude.getInstance().setOptOut(true) or equivalent."Privacy policy states 'data deleted immediately upon request' but account deletion only sets deleted_at timestamp — background hard-delete job not found in codebase" or "Account deletion API deletes auth record but does not call analytics SDK opt-out or data deletion — third-party data persists"// Example: Amplitude
amplitude.reset(); // Clears user ID and device ID
// For full deletion, use Amplitude's Privacy API