Delete your tofa account.

The short version

Email [email protected] from the address on your account and ask us to delete it. We remove your account and the data attached to it within 30 days. Your media never touches our servers, so there is nothing of your library for us to delete.

How to request deletion

There is no self-serve delete button yet. For now a person handles each request, which means we can confirm it is really you asking before anything is erased.

• Email [email protected] from the email address your tofa account uses. Sending from that address is how we know the request is yours.
• Put "Delete my account" in the subject. You do not need to give a reason, and we will not ask for one.
• If you want a copy of your data before it goes, say so in the same email and we will send it first.

We reply to confirm, then delete. If we cannot match the address to an account we will tell you rather than guess.

What gets deleted

Everything tied to your account, including:

• Your account itself: your email address and sign-in credentials.
• Your profile and display name.
• Your settings and preferences that sync between your devices.
• Your watchlist, and the watch history the cloud keeps so you can resume on another screen.
• The record linking your servers to you, and any pairings with your TVs, phones, and tablets.
• Anyone you invited to your server, and any invitation to a server someone shared with you.
• Your active sign-in sessions, everywhere. Every device is signed out.
• Your waitlist entry, if you joined the beta list.
• Any support conversations you had with us, including attachments.

What we keep, and for how long

Two things outlive the deletion, and only because we are required to keep them or cannot safely operate without them.

• Security records. A minimal log that an account was created, signed in, and deleted. We keep these to investigate abuse and to prove to you, later, that a deletion happened. They contain no watch history and no library information.
• Payment records. If you ever paid for a Supporter plan, tax and accounting law requires us to keep the record of that payment. We keep the record of the transaction, not your library or your viewing.

Separately, our encrypted database backups still hold a copy of your data until the backup that predates your deletion ages out. That takes at most 14 days. Backups are never used to restore a deleted account, only to recover from a failure.

Your library is not ours to delete

tofa is self-hosted. Your films, shows, music, and the files behind them live on your own hardware and never pass through our servers. Neither does the artwork, or the detail of what plays on your own network. Deleting your tofa account does not touch a single file, and if you keep running your server it keeps working on your own network after your account is gone.

To remove the data your own server holds, delete it there. Uninstalling the server software and removing its data folder erases its database, including local accounts and watch history.

How long it takes

We aim to delete within a few days, and we will always complete it within 30 days of confirming your request. Backup copies age out within 14 days after that. If a request is going to take longer, we will tell you why.

Contact

Questions about deletion, or want a copy of your data first? Email [email protected] and a real person will answer. Our privacy policy covers what we collect and why.