How to delete and what remains

The first step stamps the profile with a deletion time and takes it out of every list. Its cookies, its saved sign-ins and its site data stay on your disk exactly as they were.

Its encrypted session in the shared sync folder stays there too. Nothing about the first step is an erasure.

One thing does change at once: a profile in the bin no longer takes a slot of your plan.

Restore puts it back with everything it had. The plan is checked again at that moment, and a full plan refuses the restore rather than handing back a row the next sync would drop.

The second step is the one that erases. The browser of that profile is closed first, because a live process holds its files open and an erase under it fails halfway.

• The browsing data on this computer

  Cookies, saved sign-ins, caches and site storage, both in the built-in engine and in the ARMANOS Browser directory of that profile.

• The session in the shared folder

  The encrypted bundle and the marker beside it, so a second computer cannot carry the profile back.

• Everything keyed by the profile

  Its extension choices, its schedules, its start page token, its protection counters and its daily counters.

• The launch entries that carry its name

  A name that is gone must not stay readable in the notification list of the app.

• The row on the server

  And with it the shares, the extension links and the sync reports that hung on that row.

A record can be removed when its files cannot. The result of the erase is carried back and named, so a failure reads as a failure instead of a green line.

While you are signed in and the server cannot be reached, the permanent delete refuses instead of finishing locally. The copy on the server would outlive the local record, and that record is the only way to try again.

An entry says who deleted what and when. It is written at the moment of the action, and it hangs on no profile row, so removing the row cannot remove it.

The profile's name goes into the entry on purpose. After a permanent delete there is nowhere else to read it, and a log that says a profile was deleted without naming it answers nothing.

This is the deliberate exception on this page. A team with no record of who deleted what has no way to settle the question afterwards.

Your other machines learn about a deletion at their next sync. A profile sitting in the account's bin keeps its data on each of them, because restoring it has to give back a working profile.

A profile in neither list is the one whose data is erased locally as well. When that question cannot be answered, or when the server answers with an empty list, nothing is erased and the app says so.

A profile a teammate shared with you is a separate case. Losing access looks exactly like a deletion from here, so the record moves and the data stays.

Deleting every profile empties the list and does nothing else. The account keeps your email, the hash of your password, your devices, your sessions and the payments behind your plan.

No screen in the app deletes an account, and no route on the server deletes one either. Ask us in writing if you want yours closed.

This page puts no time on that request. Until retention is written down, any number here would be invented.

Each step above is decided in one place, and those places are listed below. The stands named there run the code rather than read it.