Player Data Deletion

Player Disable and Data Deletion

Disable and data deletion are two different actions. Each action applies to one Game Project only. Neither action changes the global player account of the player or their data in other Game Projects.

Action	Immediate effect	Recovery
Disable	Stops sign-in and revokes all sessions. All player data stays.	An operator with player-management permission can enable the player again.
Request deletion	Disables the player, revokes all sessions, and starts the grace period.	Before the purge, the person who made the request can cancel it. A player cannot cancel a request from the Game Project team.
Purge	Deletes the player and its data in the Game Project.	None.

Password rule

A player who has a password must send it again to disable or to request deletion. A player with no password sends an empty object. This includes anonymous players, Steam players, custom-token players, and players that joined through an invite to a global account.

Disable a player

Call POST /v1/auth/disable with the Game Project API key and the current session of the player.

curl -i -X POST http://localhost:8080/v1/auth/disable \
  -H "Authorization: Bearer <api_key>" \
  -H "X-Session-Token: <access_token>" \
  -H "Content-Type: application/json" \
  -d '{"password":"<current_password>"}'

Success returns 204 No Content. All access and refresh tokens stop working immediately. Sign-in fails until an operator enables the player again. Disable does not schedule deletion.

Request permanent deletion

Call POST /v1/auth/delete. It uses the same authentication and password rule as disable.

curl -s -X POST http://localhost:8080/v1/auth/delete \
  -H "Authorization: Bearer <api_key>" \
  -H "X-Session-Token: <access_token>" \
  -H "Content-Type: application/json" \
  -d '{"password":"<current_password>"}'

Success returns the time of the request and the time when the purge can start:

{
  "delete_requested_at": "2026-08-10T22:13:25Z",
  "scheduled_purge_at": "2026-09-09T22:13:25Z"
}

The request disables the player and revokes all sessions immediately. Show scheduled_purge_at to the player, so they know the last time to cancel. A second request while a deletion is pending returns 409. It does not restart the timer.

Cancel a pending deletion

A player with a password can cancel with POST /v1/auth/delete/cancel. Send the Game Project API key, the email, and the password. Do not send X-Session-Token. The deletion request revoked all sessions and blocks sign-in.

curl -i -X POST http://localhost:8080/v1/auth/delete/cancel \
  -H "Authorization: Bearer <api_key>" \
  -H "Content-Type: application/json" \
  -d '{"email":"player@example.com","password":"<current_password>"}'

Status	Meaning
204 No Content	The deletion is cancelled.
404	The email is unknown, the password is wrong, or no deletion is pending. All three give the same answer, so the route does not show deletion state.
403 delete_requested_by_team	The Game Project team requested this deletion. The player cannot cancel it. Only an operator can. GG Scale sends this answer only after the password is correct.

A player with no password cannot use this route. If the player has a linked global account, they can cancel on the Player Accounts website. If not, an operator must cancel the request.

Cancel removes only the disable that the deletion request made. If an operator disabled the player before the request, the player stays disabled after cancel. While a deletion is pending, an operator cannot enable the player. Cancel the deletion first.

Player Accounts website

A player with a linked global account can manage deletion outside the game:

1. Sign in at /v1/players/account/.
2. Find the game in the list of linked Game Projects and select Delete data.
3. Read the Game Project name and the grace period, then confirm.
4. To stop the deletion, select Cancel deletion.

The player cannot unlink a Game Project while a deletion is pending. This keeps the cancel path open. A player cannot cancel a request from the Game Project team on this website either. See Player Accounts.

Control panel

An operator with player-management permission can open Account Tenant → Game Project → Players → Player and do these actions:

• Disable or enable the player. This does not delete data.
• Request deletion for the player.
• See the scheduled purge time.
• Cancel a pending deletion.
• Change a request from the player into an admin deletion, with Make this an admin deletion. The purge time does not move. The player can no longer cancel the deletion.

The platform audit log records requests and cancels from the control panel. The purge writes a player.purge service audit event.

What the purge removes

A background job runs each hour. After the grace period, it deletes the player row and its data in that Game Project. This includes sessions, presence, leaderboard entries, cloud saves, matchmaking tickets, game invites, and game sessions that the player hosted or joined.

The global player account and data in other Game Projects stay. Audit records also stay, but GG Scale removes references to the deleted player where necessary.

scheduled_purge_at is the earliest time of the purge. The purge usually occurs on the next hourly run. If a cancel and the purge occur at the same time, the first one to finish wins. A cancel cannot bring back data after the purge.

Configure the grace period

On a self-hosted server, set PLAYER_DELETE_GRACE_PERIOD to a positive Go duration. The default is 720h (30 days):

PLAYER_DELETE_GRACE_PERIOD=720h

This value controls when pending requests become ready for the purge. Select a period that agrees with your privacy policy and your legal obligations.

Full reference: POST /v1/auth/disable, POST /v1/auth/delete, and POST /v1/auth/delete/cancel.