Bug: Account deletion does not purge data from all storage backends (GDPR risk)

[omi-discord-vector]

Bug: Account deletion does not fully delete user data (potential GDPR violation)

Priority: High — data retention policy does not match actual behavior; potential breach of European data laws.

Problem

The app states that deleting your account removes all data. However, after deleting and re-registering, all conversations, memories, app subscriptions, and other data are still present and fully accessible.

Root Cause

backend/database/users.py::delete_user_data() only deletes Firestore subcollections (conversations, messages, chat_sessions, people, memories, files) and the user document. It does NOT delete:

1. Vector embeddings (Pinecone) — delete_vector() and delete_memory_vector() in backend/database/vector_db.py are never called during account deletion
2. Audio recordings in cloud storage — no storage bucket cleanup
3. Typesense search index entries — no index cleanup
4. Analytics data — analytics collection entries referencing the user are retained
5. Subscription data — appears to persist across account deletion

Additionally, if the user re-registers with the same authentication method, they may receive the same Firebase UID, which would reconnect them to any data that wasn't properly purged.

Expected Behavior

Account deletion should remove all user data across all storage backends:

• Firestore documents (currently done)
• Pinecone vector embeddings
• Cloud storage (audio recordings, speech samples)
• Typesense search index
• Analytics data
• Any cached/derived data

Regulatory Impact

The app's in-app statement that account deletion removes all data may not comply with:

• GDPR (EU) — Right to erasure (Article 17)
• CCPA (California) — Right to delete

If data is retained after a user explicitly requests deletion, this is a compliance risk.

Suggested Fix

Update delete_user_data() or the /v1/users/delete-account endpoint to also:

# Delete vector embeddings
vector_db.delete_vectors_for_user(uid)

# Delete audio recordings from cloud storage
storage.delete_user_recordings(uid)

# Delete Typesense index entries
search.delete_user_conversations(uid)

# Delete analytics data
delete_user_analytics(uid)

Questions for the user

• Did you re-register with the same email/auth method?
• Which platform (iOS/Android)?
• How long between deletion and re-registration?

---

Reported by community member on Discord.

[beastoin]

Note: PR #5109 (merged) fixed the export side of this — GET /v1/users/export now returns full data. This issue tracks the deletion side — account deletion still doesn't purge Pinecone vectors, cloud storage audio, Typesense index, or analytics data.

[ZachL111]

Working on this. Account deletion only wiped Firestore. Pinecone vectors and GCS recordings survived. Adding a best-effort purge to the deletion wipe: enumerate IDs (IDs-only, before the Firestore wipe removes them) and delete conversation/memory/action-item/screen-activity vectors + conversation recordings, each backend isolated so a failure never blocks the wipe. Scoping honestly though, X-post vectors (no delete helper), other GCS buckets, and the externally-indexed Typesense remain as follow-ups, so this is a partial fix rather than a full close. PR will follow. I can make it more comprehensive if needed and I will just need that clarified when the PR comes.