# Erasure after a grace period

The repository's architectural decision, rationale and consequences.

# Erasure after a grace period

**Status:** accepted · **Date:** 2026-10-23 · **Related:** [ADR-0009](0009-row-level-security.md), [ADR-0015](0015-autofolio-data-model.md)

Deleting an account erased the User's households at once (US29, RNF09), and a household shared with other Members stayed with nobody to manage it. The privacy spec (§2, issue #74) asks for a 30-day grace period, immediate sign-out and share revocation, and a choice for each car other people use: transfer it to one of them or delete it with the account. The ledger's ★ tables are append-only, so a car with history cannot be deleted on its own, and its rows cannot move to another Organization.

## Decision [#decision]

- **Which households go.** Every Organization nobody else manages (owner or admin), as long as the User manages it or is its only Member (`householdsErasedWith`, `packages/db/src/erase-user.ts`). Members who were only granted cars do not keep the household. One with another manager stays; the User only leaves it.
- **★ rows go only with their Organization**, as before: the household is deleted whole and cascades. No single car is deleted, so the append-only trigger keeps its one exception.
- **A transfer is a History Transfer.** A car handed to a Member is offered to their own household when the deletion is scheduled, with its technical history (services, readings, photos, documents). Accepting copies it: the new rows are the Member's, authored by them and marked `from_previous_owner`, so the transferred history is anonymised ("previous owner") without rewriting a row, and nothing in it names the deleted User. Expenses and money never travel. An offer not accepted by the deletion goes with the household.
- **The schedule is a column, not a table.** `user.deletion_scheduled_at`, exposed on the Better Auth session, locks the account: `requireActiveOrganization` refuses it and the app shows only P-Excluir-Agendada. Scheduling deletes every session and MCP token and revokes passports, showcases, unused invite links and pending invitations at once. Keeping the account clears the column and withdraws the handovers; revoked links stay revoked.
- **The cron tick runs due deletions** (`pendingErasures`): the same erasure Better Auth's delete runs, then the User row, in one transaction per User. "Delete now" stays Better Auth's `deleteUser`.

## Consequences [#consequences]

- A household's other Members lose access to its cars when it goes; they keep only what they accepted. They are emailed at scheduling time, and again when the account is deleted at once ("Delete now", the web's immediate deletion, an admin's removal).
- The web schedules from Settings → Danger zone too, and its `/_auth` guard shows a scheduled account only `/deletion-scheduled` (keep, delete now, sign out), as the app does (#81).
- An account whose deletion is due is erased within a few cron minutes; five per tick.