Account & Data Deletion: The Signal Stores Look For

If your app lets people create an account, Google Play and privacy law increasingly expect you to give those people a way to delete that account and the data behind it. Google Play's Data deletion policy asks apps that support account creation to also offer account deletion, including a deletion path users can reach via a public web URL, not only inside the app. GDPR's right to erasure points the same way for anyone with EU users. For a launching indie developer, a missing deletion route is one of the most common, and most avoidable, reasons a submission stalls in review.

LaunchTrust treats an account or data-deletion route as a positive signal: something you generally want present on your public surface. Its absence is not proof you are out of policy, but it is a gap worth closing before you submit.

What LaunchTrust checks

The data_deletion detector inspects the HTML of the single public page you point it at. It does not log in, follow the deletion flow, crawl your whole site, or confirm that deletion actually happens on your backend. It looks for two kinds of evidence in the page source:

1. A deletion-oriented link. It scans href attribute values for targets that combine a deletion verb with an account/data noun — a path or URL containing patterns like delete account, account deletion, remove data, or delete profile. The match is case-insensitive and length-bounded, so it keys on realistic link text rather than huge attribute blobs.
2. Deletion wording in the page text. Independently, it looks for phrasing such as delete your account, delete your data, account deletion, data deletion, or right to erasure / right to be forgotten.

If either the link or the wording is present, the detector returns a result. The three signals mean:

• Detected — a deletion link or deletion wording was found in the page. Reported at an informational level. This confirms the page references a deletion route; it does not verify the route works end to end.
• Not detected — neither was found. Reported at a low level, because the page you scanned does not surface the route a reviewer or user would look for.
• Unable to determine — the page was not fetched (no status), so there was no HTML to inspect.

This is signal reporting, not a verdict. "Detected" tells you the route is referenced on the page; it cannot tell you the form submits, the backend purges the records, or your retention practices are correct.

Why it matters

Two distinct hooks make this signal worth closing before launch:

• Google Play Data deletion. Google Play asks apps that allow account creation to also let users request deletion of their account and associated data — reachable both in-app and via a publicly accessible web URL you enter in the Play Console Data safety form. A page that surfaces this route is exactly the public signal a reviewer, and the form, looks for. See the Google Play Data safety checklist for how this fits the wider form.
• GDPR right to erasure. Under the GDPR, individuals have a right to have their personal data erased in defined circumstances. If you have EU users, a clear self-service way to request account and data deletion is a practical part of honoring that right. The GDPR checklist for indie apps covers the broader expectations.

One deletion route plus a public URL can support the store form and give EU users a recognizable path to erasure.

A concrete example

A page that would be detected might carry this link in its footer or account settings:

<a href="https://yourdomain.com/account/delete">Delete your account and data</a>

The href contains delete plus account, and the link text contains delete your account — either alone is enough. A help page would also match with plain copy such as "Delete your account. To request account deletion and erasure of your associated data, sign in and open Settings, then Delete account."

What will not be detected is a deletion flow that lives only deep inside the native app, with no public web URL and no wording on the page you scanned — precisely the gap the Play deletion policy is designed to surface.

How to address it

1. Build the deletion flow first: an in-app "Delete account" action that removes the account and purges, or anonymizes, the personal data tied to it on your backend.
2. Publish a public, no-login deletion page (for example https://yourdomain.com/account/delete) explaining what gets deleted, what may be retained for legal reasons and for how long, and how to start the request.
3. Link to it from a discoverable place — your footer, account settings, and your privacy policy — using clear text like "Delete your account."
4. Enter the deletion URL in the Google Play Console Data safety section if you ship on Android, and align it with your Apple privacy declarations and your Google Play Data safety answers.
5. Use plain, matchable language ("delete your account," "data deletion," "right to erasure") rather than vague phrasing like "manage my info."
6. Confirm the page returns 200 and is not behind authentication or a redirect, then re-scan to verify the route is now detected.

Check this in 30 seconds

Run your site or app's web page through the free LaunchTrust scanner. It tells you whether a deletion link or deletion wording was detected on the page you submit, so you can confirm the route is publicly visible before a reviewer or a Play Console form goes looking for it. No account is required for a basic scan, and the signal comes back in seconds.

FAQ

Does every app need an account deletion option? Generally, if your app lets users create an account, Google Play expects you to also offer account deletion reachable outside the app. Apps with no accounts and no stored personal data have less to surface, but a deletion path is still good practice if you hold user data.

Does the detector confirm my deletion flow actually deletes data? No. It only checks whether a deletion route is referenced on the page you scan — via a link or wording. It cannot see your backend, submit the form, or verify records are purged. Treat "detected" as confirmation the route is published, not that it works.

Where should the deletion link live? Somewhere discoverable and, for Google Play, reachable as a public web URL without logging in — commonly a footer link or a help page, alongside the in-app action. Linking it from your privacy policy helps users and reviewers find it.

Does this confirm my app follows store rules? No. The detector surfaces a single signal — whether a deletion route is referenced on a page — and nothing more. It is not legal advice, it does not certify your data practices, and a "detected" result is not a guarantee of store approval. Use it as one input alongside the actual deletion flow and your own legal review.

Compliance aid, not legal advice. LaunchTrust reports signals, not a verdict or certification.