Data deletion
Updated: 6 October 2026 · Private testing / limited provider-review phase
Make a safe request
Write to legal@getpws.com or by post to Charline Bramorski, sole trader operating as Moonlio Digital, Akeleiweg 2a, 22607 Hamburg, Germany. Identify the relevant PWS account/workspace, provider and whether you want to end access, erase particular data or delete the account. Persons without a PWS account may also exercise rights concerning their own data. Do not send passwords, tokens, passkeys or an unsolicited identity-document copy. Where there are reasonable doubts, we request only necessary additional identity information; a fresh passkey may support verification for an existing access.
Handling and deadlines
We provide information on action taken without undue delay, generally within one month of receipt. Where required by complexity or number, this may be extended by up to two further months; reasons and extension are communicated within the first month. A refusal is explained with reasons and complaint options. Statutory rights are generally free of charge. Shorter provider deadlines remain applicable. For erasure, we assess remaining purposes and specific statutory exceptions instead of generally exempting all security data.
End access and erase account data
Current access is private and Owner-bound. The system can block sessions/permissions and record an erasure request; fully automatic final account deletion is not yet released. Following identity verification, the affected active data, local copies, provider access and backups are inventoried separately. A request is confirmed as fully completed only when required steps and remaining statutory exceptions have been accounted for. Blocked access alone does not prove complete erasure.
Platform access and platform data
Removing PWS credentials/connections, revoking provider authorization and deleting the external account are different operations. An uncertain revocation may need further reconciliation; no delivery is allowed meanwhile. PWS erasure does not automatically delete content published on Telegram, Bluesky, YouTube, Instagram or TikTok. Their own erasure routes and retention also apply. Erasure of stored YouTube data can be expressly requested from PWS; Google requires this as soon as possible, no later than seven calendar days after the corresponding user request, account closure or revocation in PWS. In-app revocation also requires immediate programmatic token revocation; external Google revocations and refresh or erasure of other API data have additional 30-day rules. Also revoke access through Google account permissions. Continuous server/dormancy/backup erasure within all provider deadlines has not been fully accepted and remains to be resolved before external product release. This is not a waiver of the duties.
Local files, media and backups
Originals, exports and user-created Mac/synchronization backups are not remotely erased by a server request. Temporary TikTok delivery links expire after 90 minutes; existing maintenance removes copies, not automatically the private source file. Hetzner has seven rotating server-backup slots, replaced only by successful new backups. BX11 currently keeps all encrypted versions without automatic expiry. Erasure from the active system and all old backups therefore does not complete at the same moment. Restore must respect current blocks/erasure requests. A continuously accepted deletion/expiry process for historical full backups remains outstanding; no immediate complete backup wipe is claimed.
Exceptions and evidence
A specific statutory retention obligation or necessary establishment, exercise or defence of legal claims can justify a limited exception under Article 17(3) GDPR. The necessity of minimal current revocation/revision blocks is assessed against erasure interests; it does not justify keeping all Chronicle events, content and backups indefinitely. Data that cannot be erased are restricted to the necessary purpose, with reasons, scope and remaining duration or criteria explained. Recipients are informed of rectification, erasure or restriction where Article 19 GDPR requires it. Rights and complaints: Privacy information.