Give users the ability to deactivate their account and destroy personal info

[tobyzerner]

_1 Upvote_ Before Flarum reached beta, we had implemented a feature that allowed users to delete their account, purging it completely from the database. However, we quickly realised this was problematic for various reasons.

Instead we want to offer users the ability to permanently deactivate their account: make it so it can't be logged into, and remove their email and other personal info from the database.

What needs to be done:

• Create a DeleteAccountModal which gives users info about what it means and confirms that they want to proceed
• Add a button to the SettingsPage (accountItems) that opens the DeleteAccountModal
• Make the DELETE /users/{id} API endpoint only disable the account for non-admin users, rather than deleting it completely...
• ...where "disabling" means setting their email to null, and destroying their avatar/bio.
• We would want this to require a sudo mode token (Improve API security #250)

[darkspotinthecorner]

Just 2 cents on the deletion process:

The company I work for is hosting and managing more than 50 forums. We often deal with the problem that users want their deletion undone the next day or so. We created our own deletion process that puts the accounts on inactive (this hides any personal information) for around 30 days and sends the users a mail with a re-activation link. If no action occurs, the account is completely deleted after the 30-day period.

This takes a lot of work from the community managers shoulders, as they no longer have to respond to that many re-activation and deletion requests.

[younes0]

+1 @darkspotinthecorner

[dcsjapan]

Make the DELETE /users/{id} API endpoint only disable the account for non-admin users, rather than deleting it completely...
...where "disabling" means setting their email to null, and destroying their avatar/bio.

Disabling the account should:

• Place the account in "suspended permanently" status (to prevent access to content).
• Nullify the user's email address, bio, and avatar (as above).
• Disable all email notification settings (to prevent attempts to send email to a null address).

It might also be good to add a flag that extension developers can use to identify a bit of information that should be nullified when the account is disabled. That would come in handy for an extension that adds custom fields to the profile page, for example (not to mention the bio, once it becomes an extension).

[SamsungGalaxyPlayer]

I want to throw in my two cents that we have users who care very deeply about their privacy, so we would like to allow users to automatically delete their account. It's okay for a temporary window perhaps (maybe 30 days) before the action is completed fully, but the window would only be for a user to reverse the action, or for mods to indicate it's required to keep the user records for a compliance purpose.

[luceos]

I think this should be dispersed towards the community, an initiative for GDPR compliance was already started and needs some additional effort to allow configurable ways to delete/invalidate accounts.