Status: accepted · Date: 2026-10-23 · Related: ADR-0009, ADR-0015
Deleting an account erased the User's households at once (US29, RNF09), and a household shared with other Members stayed with nobody to manage it. The privacy spec (§2, issue #74) asks for a 30-day grace period, immediate sign-out and share revocation, and a choice for each car other people use: transfer it to one of them or delete it with the account. The ledger's ★ tables are append-only, so a car with history cannot be deleted on its own, and its rows cannot move to another Organization.
Decision
- Which households go. Every Organization nobody else manages (owner or admin), as long as the User manages it or is its only Member (
householdsErasedWith,packages/db/src/erase-user.ts). Members who were only granted cars do not keep the household. One with another manager stays; the User only leaves it. - ★ rows go only with their Organization, as before: the household is deleted whole and cascades. No single car is deleted, so the append-only trigger keeps its one exception.
- A transfer is a History Transfer. A car handed to a Member is offered to their own household when the deletion is scheduled, with its technical history (services, readings, photos, documents). Accepting copies it: the new rows are the Member's, authored by them and marked
from_previous_owner, so the transferred history is anonymised ("previous owner") without rewriting a row, and nothing in it names the deleted User. Expenses and money never travel. An offer not accepted by the deletion goes with the household. - The schedule is a column, not a table.
user.deletion_scheduled_at, exposed on the Better Auth session, locks the account:requireActiveOrganizationrefuses it and the app shows only P-Excluir-Agendada. Scheduling deletes every session and MCP token and revokes passports, showcases, unused invite links and pending invitations at once. Keeping the account clears the column and withdraws the handovers; revoked links stay revoked. - The cron tick runs due deletions (
pendingErasures): the same erasure Better Auth's delete runs, then the User row, in one transaction per User. "Delete now" stays Better Auth'sdeleteUser.
Consequences
- A household's other Members lose access to its cars when it goes; they keep only what they accepted. They are emailed at scheduling time, and again when the account is deleted at once ("Delete now", the web's immediate deletion, an admin's removal).
- The web schedules from Settings → Danger zone too, and its
/_authguard shows a scheduled account only/deletion-scheduled(keep, delete now, sign out), as the app does (#81). - An account whose deletion is due is erased within a few cron minutes; five per tick.