Account & Data Deletion

1. Before You Delete: Export Your Data

Deletion is permanent, and because your data is decrypted only on your device, we have no readable copy to give you afterwards. To keep a copy, open Twin Leaf and choose Settings › Your data › Download everything (CSV). This saves all of your transactions, including hidden ones, as a CSV file on your device. You can also download filtered transactions from the Transactions page. Budgets, goals, rules, and settings are not included in the CSV; note anything you want to keep.

2. Delete Your Account in the App

Open Twin Leaf and unlock it.
Go to Settings, scroll to Your data, and choose Delete my account.
Confirm with Delete everything.
If you have not signed in within the last few minutes, Apple or Google will ask you to confirm it's you.
If you have a Coach Plus membership paid through Stripe, Twin Leaf cancels it first, immediately and with no further charge. If it cannot, it stops and tells you, and nothing is deleted. A membership bought through Apple must be cancelled by you in iPhone Settings › your name › Subscriptions.
Twin Leaf deletes your data, then your sign-in, then the copy on this device, and returns you to the sign-in page with a confirmation.

2.1 If You Can't Unlock

If you have lost both your PIN (or passcode) and your recovery code, sign in and, on the lock screen, choose "Lost both your PIN and recovery code? Delete your account and start over." No PIN is needed, because deletion does not require reading your data. This also means anyone who can use your signed-in browser and confirm your Apple or Google sign-in could delete your Account; protect that account and sign out on shared devices.

3. What Is Deleted, and in What Order

Every document Twin Leaf stores for your Account in Cloud Firestore — transactions, accounts, overview, import records, bills, budgets, goals, rules, alerts, paycheck details, holdings, settings (including your Terms acceptance record), and your wrapped keys — is deleted, a page at a time.
If you turned on Help improve Twin Leaf, the de-identified transactions you shared are deleted from our key service first, while your device still holds the secret that deletes them.
Any support tickets and feature requests you filed in the app are deleted from our key service, including any diagnostics summary you attached to them.
If you connected Gmail, Twin Leaf asks Google to revoke its access. The email fingerprints and learned sender patterns, and any charges and balances you accepted from emails, are part of your encrypted data and are deleted with it in the first step. Twin Leaf never kept the emails themselves.
If bank connections through Plaid are offered and you connected a bank, each connection is disconnected first (Plaid is asked to remove it, and our token, sync position and waiting transactions are deleted). Plaid keeps its own copy under the Plaid End User Privacy Policy.
Your sign-in record in Firebase Authentication (name, email, provider identifiers) is deleted.
The encrypted copy on that device is erased, and the key is cleared from the app's memory.

If deletion is interrupted part-way — for example by a lost connection or Twin Leaf's daily free usage limit — your Account still exists, nothing is orphaned, and you can press Delete again to finish. If a step stalls, the app stops and tells you rather than waiting indefinitely. While deletion runs, nothing new is saved. If it was interrupted, the next time you sign in on that device Twin Leaf asks whether to finish deleting or keep the Account as it is. If the daily limit is reached, deletion can be finished after midnight Pacific Time.

4. What May Remain

Item	What happens
Encrypted copies on your other devices	Erased when that device next signs out; you can also clear site data in that browser. They cannot be opened without your passcode or recovery code (subject to the limits on our Security page).
Preferences in your browser	twinleaf.theme and twinleaf.lastAccount stay until you clear site data.
Residual copies in our providers' systems	Google may retain deleted data for a limited period under its own deletion practices before it is permanently overwritten. Copies of financial data are encrypted.
Passcode-attempt counter on our key service	If one exists, it holds only a count, a time, and a tag. Ask us and we will delete it.
Support-ticket filing times	The times of tickets you filed in the last 24 hours, under a tag, so the filing limits still apply; gone within 24 hours. If deleting your tickets fails, ask us and we will delete them; otherwise they are deleted automatically 2 years after their last update.
Shared transactions (only if Help improve Twin Leaf was on)	Deleted first, as above. If your device could not delete them (for example you deleted your Account from the lock screen without unlocking, or our server could not be reached), they are filed under a random number we cannot link to you, and are deleted automatically 12 months after their last update. Turning the setting off at any time also deletes them; see the Data Sharing Notice.
Consent records (key service)	Kept while your Account exists, and for six years after you delete it, so we can show what you agreed to if a dispute arises. Erase my data does not change this. They hold a keyed code, not your name or email, the document, its version, the server time, and how you agreed. Section 13 of our Privacy Policy explains the basis and the period.
Membership records (key service; only if you started Coach Plus or took a free hardship month)	Kept for seven years after you delete your Account, so we have our tax and accounting records for the membership and can answer a payment dispute, then deleted. Twin Leaf cancels a Stripe membership first, as above. The record holds a keyed code, not your name or email, whether it was active, the Stripe customer and subscription identifiers and any hardship months. Erase my data does not change this. Stripe keeps its own invoice and payment records for the periods the law requires of it.
App performance and error reports (only if the setting was on)	Not deleted with your Account, because they are anonymous daily totals with no user ID that we cannot trace back to you. Turn the setting off to stop them; the totals are deleted 12 months after their day.
Staff access log (key service)	Kept for two years. It records staff actions on support tickets and accounts under a staff code, not your name or email. It is not deleted with your Account, so entries about your Account can remain until they expire.
Key-service logs and their copies	Contain a keyed hash of the IP address and an account tag, no financial data, and are deleted as described in Section 13 of our Privacy Policy.
Anything written in the hour after deletion	A sign-in token can stay valid for up to an hour. It cannot reach your deleted data; if anything is written under your deleted account in that hour, we will delete it on request.
Emails you sent us	Kept as described in our Privacy Policy, or deleted on request.
Information we must keep by law	Kept only as long as the legal obligation or claim requires.
Your Apple ID or Google Account	Not affected — those are yours, with Apple or Google.
Twin Leaf's access to your Gmail	Twin Leaf asks Google to revoke it when you disconnect or delete your Account. If that could not be done (for example you were offline), remove it yourself: myaccount.google.com › Security › Your connections to third-party apps & services › Twin Leaf › Delete all connections. It cannot read your email without the short-lived token your browser asks Google for again each time.

5. Timing

In-app deletion takes effect in the live database and sign-in system immediately, typically within seconds.

6. Asking Us to Delete Your Account

If you cannot sign in — for example, if you no longer have access to the Apple ID or Google Account you used — email support@angelgatesolutions.com from the email address associated with your Account (or explain why you cannot). We will verify that the request comes from the Account holder, delete the Account and all of its stored data, the key-service counter, and the log lines we can link to it, using our administrative tools, and confirm when it is done, within 30 days and usually much sooner. We cannot provide a readable copy of your data.

7. Disconnecting Apple or Google

Deleting your Twin Leaf Account does not remove Twin Leaf from the list of apps connected to your Apple ID or Google Account. You can remove it yourself:

Apple: Settings › your name › Sign in with Apple (or account.apple.com › Sign-In and Security › Sign in with Apple), choose Twin Leaf, and stop using it.
Google: myaccount.google.com › Security › Your connections to third-party apps & services, choose Twin Leaf, and delete the connection.

8. Starting Over

You can create a new Account at any time by signing in again after your Account is deleted. It starts empty, with a new data key and recovery code; deleted data cannot be restored into it.

8.1 Erase Your Data but Keep Your Account

Settings › Your data › Erase my data and start over deletes every document Twin Leaf stores for your Account — transactions, accounts, overview, import records, bills, budgets, goals, rules, alerts, paycheck details, holdings, and settings (including your Terms acceptance record, so you will be asked to accept the Terms again) — but keeps your wrapped keys and your sign-in. The same sign-in and PIN then open an empty Twin Leaf, and the guided start runs again. It cannot be undone. It does not cancel a Coach Plus membership; to end everything, delete your Account instead. If Help improve Twin Leaf was on, the transactions you shared are deleted first.

9. Inactive Accounts

We do not currently delete inactive Accounts automatically. If we adopt such a policy, we will give notice in the app and, where possible, by email well in advance, so that you can export your data.

10. Contact

Angel Gate Solutions, LLC

Product: Twin Leaf (twinleaf-app.web.app)

State of formation: Florida

Address: Available on request via support@angelgatesolutions.com

Email: support@angelgatesolutions.com

Used for: support, privacy and data requests, legal notices, arbitration opt-outs, copyright (DMCA) notices, and security reports. For a security report, use the subject "Twin Leaf Security Report".