Delete your account and your data
There are three different things people mean by "delete my data", and they are not the same. Pick the one you actually want.
1. Clear this phone — sign out
Settings → Log out.
Erases from the phone: your outings and tracks, your contacts, your messages.
Keeps on the phone: your downloaded map areas, because they contain nothing about you and re-downloading them is slow and expensive. Delete them explicitly from the offline maps screen if you want the space back.
Keeps on the server: everything. Signing out is not deletion. Your account still exists and you can sign in again.
If positions or outings have not yet reached the server — because you were out of coverage — the app tells you what would be lost and asks you to confirm. If you see that warning, cancel, get some signal, let it sync, then sign out. The app will not let you sign out while an outing is still running.
2. Remove a device you no longer have
Settings → Devices → revoke.
Use this if a phone is lost, stolen or sold. It signs that device out and stops it acting as you. Your account and your data are untouched.
Do it from another phone as soon as you can.
3. Delete your account and everything we hold
Settings → Your data → Delete my account.
It happens in the app, immediately, and nobody at Alpik has to approve it.
What the app asks you for
- A summary of what goes, and of the one thing that stays. Read it — the part about the security trail is the part people do not expect.
- A tick box, I understand this cannot be undone, which is what enables the button. Deliberately a second, separate act rather than a slip of the thumb.
- Your password, once. Being signed in is not enough for this: a phone somebody else has picked up is already signed in. Typing your password is what proves the person deleting the account is the person who owns it. If the sign-in comes back as a different account — easily done on a shared handset — the app stops and deletes nothing.
Then you are signed out, and deletion starts.
This is not a request that sits in a queue for a week while you reconsider. Within seconds of you confirming, your identity is destroyed at our identity provider and your data is being deleted. There is no "undo" window, no cancellation link in any email, and nothing support can restore.
If you are not certain, get a copy of your data first and decide afterwards.
You will get one email when it is finished. There is no "we received your request" email, because by the time you could read it the account would already be gone.
When it will refuse
Deletion is refused — with nothing deleted, and the reason named — in two situations:
- You have an SOS raised. Clear it first.
- You own an outing that is active and shared with somebody. End it first.
Both refusals exist for the same reason: deleting your account deletes the outing and the position history behind it, and doing that to a trip other people are actively watching would take away their tracking without telling them. On a safety product that is the worst thing this feature could do.
A solo outing with nobody watching does not block anything.
What gets deleted
- Your account, your profile, and your login at our identity provider.
- Your outings, tracks and the whole position history behind them.
- Your outing plans and routes stored on our servers, and your GPX traces.
- Your messages — everywhere, including the ones you sent to other people's outings. They are removed from those threads, not merely detached from your name.
- Your contacts, your sharing relationships, and the contact rows other people hold pointing at you.
- Your Jikita tag registrations.
- Your devices, their keys, and your push notification registrations — which are also revoked at the notification provider, not just deleted here.
- Any copy of your data you had asked for and not yet downloaded.
- Your coverage gaps, your notification history, and your email suppression record.
What does not, and why
The security trail. This is the one category that survives, and it is deliberate. Every security-relevant event concerning your account — sign-ins, device activations and revocations, SOS raised and cleared, the record of this deletion itself — stays in an append-only log.
It is kept indefinitely, and it is minimised at the moment it is written rather than cleaned up afterwards: it holds timestamps, event names, identifiers and an IP address, never message content, never positions, never your communications. It exists so that there is evidence if your account is ever disputed or abused, and so that the record of us deleting your data cannot be altered by the same system that deleted it. No account anywhere in the platform has permission to delete from it.
Jikita tag sightings. A sighting is a record about a tag, not about the phone that heard it, and it carries no reference to you at all — which is why there is nothing in it to erase. Sightings your phone submitted concern other people's devices and expire on their own schedule.
Backups. Deleted data persists in backups until those expire on their normal cycle. It is not restored into service.
Anonymised and aggregate data, which can no longer be connected to you.
Anything we must keep by law. Where a statutory retention requirement applies, it overrides this page. In practice this is rare and we will tell you if it affects your request.
The record of any access a rescue service made to your data — what was done, when, and by which operator — is kept for the lifetime of your account and goes with it.
If you ever want to question how a rescue service handled your data, raise it with that service's Data Protection Officer before you delete your account, using the address in the notification email they sent you. See Who can see your position.
How long it takes
Seconds. Deletion begins the moment you confirm, and in normal operation it is finished before you have put your phone down. The email confirming it is sent when the work is actually complete, not when it was requested.
The one month the GDPR allows us is the outer legal bound for something going wrong repeatedly, not the working expectation.
Afterwards
Your email address is released. You can register again with the same address and get a brand-new, empty account — no outings, no contacts, no history. Nothing is carried over, because there is nothing left to carry.
Before you delete
- Stop any running outing. Do not leave contacts watching a position that has stopped for a reason they cannot see. The app will refuse anyway if the outing is shared.
- Get a copy of your data first, if you want to keep any of it. See What do you know about me — it takes minutes, and after deletion it is not available at any price. Your GPX files are already on your phone in a standard format; copy them off too.
- Tell the people who follow you, so nobody is left assuming an alarm will fire that no longer can.
If you cannot use the app
If you have uninstalled the app, lost the phone, or cannot sign in, email privacy@alpik.fr from the address on your account and ask for your account to be deleted. We will respond within one month.
The in-app route is faster and does not require you to prove anything to a human — use it if you can.
Once your account is deleted it cannot be recovered, and neither can your history. If you only want to stop sharing, stop the outing — that is immediate, reversible, and does not cost you your data.
Deleting just one outing
privacy@alpik.fr can remove specific outings on request at the time it is ended.
Someone else's data
If you are asking on behalf of someone who has died, or as the parent or guardian of a minor, contact privacy@alpik.fr and we will tell you what we need.