How do I delete my Maditon account and everything in it?

Deletion is self-serve and it is real deletion.

Request it with DELETE /api/gdpr/delete. The request is logged as its own record, which is the compliance trail for having honoured it.

A 30-day grace period follows, during which POST /api/gdpr/delete/cancel reverses it. The window exists to make an accidental deletion recoverable, not to slow you down.

Then the data goes. Rows are hard-deleted or fully anonymised across every table that references the identity or holds identifying fields. A record kept for referential integrity does not retain personal data in any field — the alternative, a “deleted” flag on an intact row, is not deletion and would not survive a regulator looking closely.

Export before you delete. The Data Act and GDPR exports are separate endpoints and deletion does not produce a parting archive. If you want your dossiers, evidence and classifications, pull them first.