# Privacy and deletion

- **Who sees what:** a record's `acl` lists its readers. A `viewer` (or user token) sees only what they may see, and a hidden record is never confirmed to exist.
- **Deleting:** `POST /v1/memories/delete` and `POST /v1/users/delete` (the `delete` scope) remove the record at once from the store, its indexes, derived facts, usage signals and caches (freed pages are zeroed). Backups keep deleted data only until they expire. Deleting the whole account destroys its data key, so every backup of it becomes unreadable at once.
- **Export:** `POST /v1/users/export` returns a signed, short-lived download link.
- **Secrets and PII** are masked in every output: secrets always, PII by your policy.