Delete your account

In the app

This is the route. It needs nothing from us:

• open Settings in the grown-up app and scroll to the bottom;
• tap Delete my account;
• the app asks our server which children you look after and shows you, one card each, what deleting would do to them. Then it asks you to tick every consequence separately, never a single “I understand”, and to hold a button down for three seconds;
• when you let go, the row is gone from our server. If any step fails, the app says which ones happened and which did not, and nothing is retried behind your back.

A child’s account is deleted from a grown-up’s phone, on a different screen: Family, then the child, then Remove and their name. If you are their only grown-up, that deletes their account; if another grown-up looks after them too, the same button hands them over instead and everything of theirs carries on. A child’s own phone has no delete button, and no settings screen to put one in.

If you no longer have the phone

This page has no form on it, and writing to us cannot delete an account either. Both come from the same fact. The server erases an account only when the account’s own key asks it to, and that key lives on a phone. So what follows is not a workaround. It is how you get back to the button.

• Another device of your own. If you added a second phone or a tablet, it already is you, so open Settings there and the row is at the bottom, as usual. That device can also take the lost one off the list first, under Settings → Your devices. That takes two days and tells every device you have, which is the point.
• The printed recovery sheet. Open Rilo on a new phone and scan the sheet. The new phone is you again. Same account, same children, same approvals. The row is where it always was. The sheet is made under Settings → Recovery sheet, and if you are reading this with your phone still in your hand, printing one is what this page is asking of you.
• If you have neither, that account cannot be deleted by anybody, including us. The key that could sign the request is gone, and our server has no route that erases an account without one. We are not going to add one for support mail. An account id is not a secret. It is a hash of a public key, and every phone you ever paired with holds it. A server that deleted an account because an email quoted an id would delete accounts because an email quoted an id.

What is left behind is small and inert: an id, a public key, a push token that no longer wakes anything, and the date we last heard from it. No name, no email, no photo, no messages, nothing about who anybody talked to. Nobody can use that account either, for the same reason nobody can delete it. We are building an automatic clear-out of families who have stopped using Rilo altogether; until it is switched on, nothing here goes on its own.

Writing to us

For anything on this page, including a request under data-protection law:

It is an address rather than a form on purpose. The site runs no scripts and sets no cookies, and there is no login a form could check you against; a form here would be a box that collected an email address in order to look like a mechanism.

What deletion removes

Everything the server holds about the account, which is the list on the privacy page:

Removed from the server

The account row: its id, its public key, whether it is an adult or a child, and the date we last heard from it. With it go the phones registered to it, their push tokens, any introduction still waiting for an answer, every sealed message still waiting to be delivered, and the subscription record, which never held anything naming anybody. No name and no photo appear in that list, because there was never a column for either.

On your own phone

Deleting the app removes its own files: your contacts, the names you gave them, and any messages kept on the device. On iPhone the keys themselves stay in the system keychain, which is why reinstalling greets you rather than treating you as a stranger. The last step of the deletion destroys them, and erasing the phone does too. On Android the keys go with the app. None of it was ever on our server either way.

On other people’s phones

Messages already delivered to someone else are on their phone and stay there. We cannot reach into a device we have no access to. What their phone does receive is the goodbye your phone signs on its way out, so their tile goes quiet because your account said so rather than because we did.

What outlives the account

Four records, and no names in any of them. That goodbye, kept so a phone that was switched off can still check it. A hashed record that a contact ended, which says two accounts stopped without saying which two. And, where a child of yours carries on with another grown-up, the row saying you were once their grown-up, marked as ended rather than erased. Without it, every contact you approved for them would stop verifying. The first two hold the account’s id and its public key, so this is not the same as nothing. And a report, if somebody sent us one about this account, or if you sent us one about somebody else, which holds your key as the sender. A report outlives the account it is about on purpose, because otherwise anybody could delete themselves out of one. Nothing else is set aside. The software has no way to keep a deleted account’s data for a case nobody has made, and nothing of the email address you verified at sign-up survives, because none of it was ever written down.

Subscriptions

Deleting a Rilo account does not cancel a subscription. The subscription belongs to your Apple or Google account, not to ours, and only the store can end it.

Cancel it under Subscriptions in the App Store or Google Play settings, on the device where it was bought, before or after deleting the account.

Can it be undone?

No. We keep no grace period and no archive, and we cannot identify a deleted account well enough to restore it even if we wanted to. Starting again means installing the app, making a new identity, and pairing the contacts again as you did the first time.

Last updated 15 August 2026.