Delete your ZenZen account and data

Updated: October 26, 2026 · Decodation LLC

This page lets you request deletion of your ZenZen account and associated personal data, including a guest account. ZenZen is operated by Decodation LLC (com.art.zenzen; Apple app 6475656449).

1. Request deletion in the app

1. Open the chat’s privacy control or the profile’s account/data controls. The section is labelled Privacy and data or Account and data, depending on the installed version.
2. Choose Delete account and server data. Read the scope and confirm only if you want the account and its associated data deleted.
3. For an email/password account, confirm the same account with its password again when prompted. The app uses Firebase Authentication’s normal reauthentication before starting the account-erasure action, and the server separately checks recent authentication. Cancellation or failed confirmation does not start local erasure or the server deletion request. Guest accounts do not require an invented password. For a different existing sign-in provider, the app can require that provider’s recent confirmation; do not enter its password into an unrelated form.
4. Read the result. A completed automatic stage and a pending review have different meanings. When legacy or storage cleanup cannot be confirmed, the request remains pending: the Firebase account and other remaining local data, including chats, journal records, conclusions and reminder preferences, are retained rather than reporting full completion. When you explicitly confirm account deletion, the app withdraws AI-sharing consent and clears and disables managed memory with verified secure-storage write/readback before calling the server deletion operation. For the account data successfully loaded on this device, it also clears the Today plan and weekly reflections together in a verified local write before that server operation. A pending server response does not restore these cleared fields; other records such as chats and journal entries can remain while review is pending. If a required local write/readback fails, the app reports an error rather than claiming completion. If local records cannot be read or loaded, their erasure has not been verified; do not assume that a server response or an older app version erased them. To check the remaining scope, use an updated app and contact support. Known server records may already have been cleared, and AI access can remain blocked during review. Keep your account ID and use the contact option below if the app reports pending or error. Returning to the welcome screen does not itself prove complete erasure.

Check the account before deletion or switching

Updated versions offer optional sign-in to an existing email/password account through Firebase Authentication. Local records are scoped to the Firebase account ID on this device: signing in does not link, merge, move or migrate the guest account’s records and does not provide cloud synchronization for them. Export any supported guest records you need before switching or signing out; you may not be able to reopen that guest account afterwards.

The app does not persist the password in its own storage or forward it to the AI gateway or OpenAI. Password-manager/autofill storage is controlled separately by your device settings. Account confirmation is an authentication step, not confirmation of complete deletion. A pending result still has all the legacy/provider limits described below.

If your installed build has only the older Delete Account button or lacks these controls, use the email request below. The older button by itself does not verify cleanup of all device, server and provider records.

2. Request deletion without the app

Request ZenZen data deletion by email

Or write to decodationllc@gmail.com with the subject ZenZen account and data deletion request. This opens your own email app; the website does not send the request for you.

Include only what is needed to find your data:

• Your ZenZen account ID, if available. Updated data controls show an account-ID copy option. If you already have a copied test account ID, it identifies the same Firebase account.
• The email linked to the account, if you used one, and whether you used a guest account.
• Whether you want the whole account and associated data deleted, or a more limited request, such as legacy chat data.

Do not send chat contents, passwords, verification codes, authentication tokens, API keys or full payment-card information. We may ask for proportionate evidence of account ownership. A guest account may have no email, so keep its ID before signing out or changing devices. If it is lost, explain what access remains; we cannot reliably identify an old guest account from an unrelated email address.

3. What is included and what can remain

• Account and profile: request removal of the Firebase account and associated profile data.
• Current-device records: after confirmed account erasure and successful device cleanup, the app clears the current account’s conversations, drafts, conclusions, mood/energy entries and notes/tags, practice-completion/feedback records, favorites, reminder preferences and local AI-consent record. When you explicitly confirm account deletion, the app withdraws AI-sharing consent and clears and disables managed memory with verified secure-storage write/readback before calling the server deletion operation. For the account data successfully loaded on this device, it also clears the Today plan and weekly reflections together in a verified local write before that server operation. A pending server response does not restore these cleared fields; other records such as chats and journal entries can remain while review is pending. If a required local write/readback fails, the app reports an error rather than claiming completion. If local records cannot be read or loaded, their erasure has not been verified; do not assume that a server response or an older app version erased them. To check the remaining scope, use an updated app and contact support. Reminder scheduling is cancelled. This does not establish provider erasure or reach records stored only on another device; use that device’s local controls.
• Gateway data: request removal of account-linked reply-delivery and usage records. These use a hashed account identifier. A minimal block can retain the account ID while old authentication tokens may still be valid; automatic removal of that block is not promised. Shared daily budget totals are aggregate operational records, not a stored conversation history.
• Older Supabase records: request a separate review of identifiable legacy messages and profile-linked data. Their ownership and erasure need verification; new-account deletion alone does not prove these records are gone.
• Provider and purchase records: RevenueCat, Apple, Google and OpenAI can hold separate records. Relevant deletion requests require provider review. Store transaction records and legally required data can remain under the applicable provider rules and law.
• Other devices and copies: clearing data on one device does not remotely erase other devices, all backups, operating-system clipboard contents, files saved elsewhere or copies retained by export recipients.

We will communicate the request’s scope, any identity-verification needs, the expected handling time and the outcome through the request channel. Processing is subject to applicable legal deadlines. Instant full erasure has not been verified and is not promised. If any record must be retained, the response should explain the category and reason rather than imply that it was deleted.

4. Remove local records or stop AI sharing separately

Depending on your installed version, the local controls have separate scopes:

• Chats and editable conclusions: edit or remove a conclusion in its conversation, or delete one conversation through History to remove that conversation’s messages, drafts and conclusions. The bulk Delete conversations on this device action also clears the current account’s Today plan and weekly reviews. Mood/practice records, managed memory and reminder preferences are preserved.
• Journal and practice records: edit or delete individual mood entries in the wellbeing/journal screen. Its separate clear action removes local mood/energy entries, notes/day tags, practice-completion/feedback records and favorite practices. It preserves chats, conclusions, managed memory, Today, user-written weekly reviews and reminder preferences. These local records have no built-in cloud synchronization and are not automatically sent to AI. Text deliberately copied into a sent message, a saved review or a plan is separate from the original entry.
• Today and weekly reviews: edit or clear the Today action and optional card preferences through its controls. Weekly reflection fields can be edited or removed; deleting a review preserves original check-ins and practice records. They share account-scoped device secure storage with chat records, have no built-in cloud synchronization and are not automatically sent to AI or managed memory. The current export does not include these plans/reviews. Clearing original journal entries does not erase copied words in them. Bulk conversation clearing removes both Today and weekly reviews; account-deletion confirmation handles successfully loaded fields before the server request as explained above.
• Managed AI memory: memory is off by default; you manually add, edit and select entries and enable their use. It is not automatically extracted from chats, journal entries, Today or weekly reviews. Use Forget all to empty and disable current-account memory on this device, or remove individual entries. Disabling, deselecting, editing or deleting memory blocks an older pending retry that used its previous state; use an explicit new request for the new state. Only selected and enabled texts enter future AI requests through ZenZen’s server to OpenAI. This does not recall transmitted text, generated answers or server/provider records. Removing dedicated memory does not remove information already present in chat messages/answers, which can still enter recent context. Start a new chat or delete the affected conversation to stop using it as context. Clearing chats or the journal preserves memory. When you explicitly confirm account deletion, the app withdraws AI-sharing consent and clears and disables managed memory with verified secure-storage write/readback before calling the server deletion operation. For the account data successfully loaded on this device, it also clears the Today plan and weekly reflections together in a verified local write before that server operation. A pending server response does not restore these cleared fields; other records such as chats and journal entries can remain while review is pending. If a required local write/readback fails, the app reports an error rather than claiming completion. If local records cannot be read or loaded, their erasure has not been verified; do not assume that a server response or an older app version erased them. To check the remaining scope, use an updated app and contact support.
• Selected exports: no records are selected by default. Select mood/energy entries and saved user-written or edited conversation conclusions; preview before Copy, Share TXT or Preview PDF, then use a separate Share PDF action. In versions with PDF, the inclusive local-calendar date period applies to mood entries; undated conclusions require separate opt-in and individual selection. Changing the period clears selection/preview. Full chats, raw AI replies, drafts, account/internal IDs, managed memory, Today and weekly reviews are excluded. Limits are 100 selected records and 100,000 UTF-8 source bytes; PDF is limited to 20 pages, 8 MiB of page PNGs and 12 MiB total. Preparation is local with no remote renderer or font download; there is no automatic AI/specialist upload. Copy uses the system clipboard. Native TXT/PDF sharing writes a neutral-named unencrypted file into the app’s owned cache, separate from secure storage. Cleanup runs on next feature opening, sign-out or account-erasure request without an immediate-deletion promise. Opening/closing the share sheet does not prove delivery. ZenZen cannot erase clipboard contents, files elsewhere, backups or recipients’ copies; the export is personal notes, not a clinical assessment.
• Reminders: turn reminders off in the reminder settings to cancel local scheduling. You can also change notification permissions in the operating system. Turning reminders off does not erase your journal. Signing out cancels reminder scheduling but retains the local account records and preferences; signing out is not data deletion.

Local deletion does not recall content already sent to servers, erase other devices remotely, remove exported copies outside app control or guarantee removal of operating-system backups. Backup, secure-storage and uninstall behavior vary by platform and settings.

Open AI sharing and privacy and choose Withdraw consent to stop future AI requests from this account on this device. Withdrawal does not itself erase history, account data or previously processed provider records. Do not rely on uninstalling alone: device secure-storage items and backups can survive app removal.

For details about the information involved, read the ZenZen privacy notice.

AI reply reports

If you explicitly send a report about an AI reply, its selected excerpt, optional comment, reason and account linkage are stored in ZenZen’s restricted Firebase records. These report records and their rate counter are included in the account’s known server-data cleanup, including when a parent profile record does not exist. A report receipt is not a response from a human and reports are not an emergency channel.

An accepted account-deletion request is not proof that all cleanup has finished. The pending status and legacy/provider limitations described above continue to apply. External copies you shared through export or another app are outside this cleanup. The privacy notice explains the report data and transient retry state.