Havara: Deleting Your Account

Effective October 30, 2026

Last updated October 20, 2026

You can permanently delete your Havara account yourself, inside the app or on the web console, in about a minute. Deletion is immediate and cannot be undone. Your profile and personal records are erased; things you posted into shared community spaces (chat messages, notices, comments) stay visible to your neighbors but become anonymous. The author simply shows as "Member." Download a copy of your data first if you want one.

This page is the account-deletion instructions resource required by Apple App Review Guideline 5.1.1(v) and Google Play's account-deletion policy (both platforms require a full, in-app deletion path for any app that supports account creation; Google Play additionally requires a web-accessible resource, which is this page).

1. Before you delete: download your data

The export button lives right next to the delete button. Use it first if you want a copy.

Deletion is permanent and there is no recovery window, so take your copy first:

• In the app: Profile ▸ Privacy & data ▸ Download my data.
• The export is a single JSON bundle scoped to your signed-in account. The download uses format havara.personal-data-export.v2. It includes your personal activity, replies on your own requests and cases, and safe sign-in, report and delivery metadata. File contents, sign-in credentials, protected moderation work and shared association records are excluded. The Privacy Policy, Section 11 lists what is included, what is excluded and how to request other records. These exclusions do not change the deletion steps below. Take the download before deleting: once your account is deleted, it cannot be prepared again.

2. How to delete your account

Two taps to find it, two confirmations to run it.

In the iOS or Android app (either path reaches the same flow):

1. Open Profile.
2. Tap Privacy & data ▸ Delete my account, or scroll to the delete-account section at the bottom of Profile.
3. Confirm twice. The confirmations state plainly that deletion is permanent, removes you from every community, and cannot be undone.
4. On success you see an explicit "Account deleted" confirmation, are signed out, and returned to the sign-up screen. If deletion fails, you see an error and your account is unchanged. The app never pretends a failed deletion succeeded.

On the web console: Account ▸ Delete my account, with the same two-step confirmation.

If you wrote moderation case notes as a board member or moderator, those notes stay as part of the community's governance record, with your authorship cleared, the same way the rest of your content is anonymized.

If you can no longer sign in: email [email protected] from the address on your account and ask us to delete it. We verify the request against the account email and fulfill it manually; we aim to complete manual deletions within 30 days, inside the 45-day response windows common to US state privacy laws.

3. What is deleted, what is anonymized, what remains

Almost everything keyed to you personally is erased, and Section 5 names the exceptions honestly; content you contributed to shared spaces is kept for your neighbors but stripped of your identity; board records about your unit (not about your account) stay with the community.

Deletion runs server-side as a single self-only operation: the deletion runs strictly against your own authenticated account and takes no target as input, so no one can target anyone else.

Deleted immediately

Each row above is enforced by the database or the app itself, not by policy alone.

Retained but anonymized (author becomes "Member")

Content you contributed to shared community spaces stays in place so conversations and records remain coherent for the members who stay, but the link to you is cleared:

Each row above is enforced by the database or the app itself, not by policy alone.

Remains with the community (records about the unit, not about your account)

Deleting your account does not delete the community's documents or its retention schedule. When a document is deleted, its file is removed by the daily sweep, normally within two days. Before documents were included in that sweep, a file could remain in storage after its document was deleted.

• Per-unit dues standing, budget and reserve data, and unit records are board-entered community records keyed to the unit/community, not to your account, and are unaffected by account deletion. If you posted an entry on a home's balance as a community administrator (a board member, admin, super admin or declarant) or as someone the board lets handle compliance (a charge such as dues, an assessment, a fine, a fee or interest; a credit, refund or write-off; a recorded payment; or a reversal of any of them), the entry stays as posted and the link to you is cleared. If you created an assessment (what your community charges each home), it stays as the board set it and the link to you is cleared.
• Governing documents and community images (such as the logo and cover photo) uploaded by the board remain community property, including when the board member who uploaded them deletes their own account.
• A vendor's insurance certificate is uploaded by the business through an emailed link and is not tied to any member's account, so account deletion does not affect it.
• If you hold a seat on your community's board roster, your name is removed from the seat. The seat's title, optional owner-elected or declarant-appointed category and term dates are the board's record and stay with the community, shown as vacant. The category belongs to the seat and does not retain how a former holder was selected.
• If you served on your community's board, your name stays where the board recorded it in its meeting record: as the mover or seconder of a motion, beside your vote on a motion or your consent to an action taken without a meeting, and in the signature on minutes you signed. These are the association's record of what its board did. The link from each of them to your account is cleared. Signed minutes, including any signature line in their text, cannot be changed afterwards by your board or through the Havara app.
• If you served on your community's board, the insurance policies, service contracts, bids, reserve components, building inspections and maintenance tasks you recorded on its Registers page, and an operating balance you entered, stay with the association. The link to your account is cleared.
• A name written into a meeting's agenda items or into the minutes of an executive session (for example in a discipline, personnel or financial matter) stays in the association's record, whoever wrote it. If you added an agenda item, saved executive session minutes, set the meeting notice rules or set how long documents are kept as a community administrator, they stay with the association and the link to your account is cleared.
• Your requests to speak are erased, but if your board recorded that you spoke at a meeting, the draft minutes Havara prepares list your name and the item you spoke on. Once your board publishes those minutes every member reads that line, and it stays in the minutes after you delete your account.
• A document you attached to a meeting's board packet as a community administrator stays in the packet with the association, and the link to your account is cleared.
• If your board named you as the director to meet a member about a disagreement (a meet and confer request), your name and seat stay in that request's thread as they were written, and so does a resolution you and the member confirmed. The link to your account is cleared. The request itself is erased when the member who filed it deletes their account.
• A name typed on a security desk record, such as the name on a parcel's label, the name of whoever collected it, or a guest's name, is text rather than a link to your account, so it stays until that record's own deletion date. Whoever is seated on your home after you does not see the desk's records about the home from before their own seat began, except a device or space still assigned to the home, which they see until that assignment ends. The desk and the board still see those earlier records until they are deleted.

Reports on other content

In an app version offering Report or block on content pages, generic reports are kept for Havara's review even if their source disappears. Deleting the reporter's account deletes those reports. Deleting a reported author's account clears the separate author reference, but the historical record identifier remains, including an original profile identifier if the reported source was a profile. These report records are not claimed anonymous. They hold no extra copy of the source's words, medical details, photos or files. Community moderators cannot read generic reports.

Completion inspections. Deleting the requester's account removes their architectural requests and all attached completion-inspection records, including inspections the board wrote. If you inspected someone else's project, deleting your account clears your inspector account link while that requester's retained notes, results and photos stay in history. Their prose, images, file metadata and already returned copies may still identify you. Unreferenced completion photos become eligible for daily file cleanup after 24 hours or uploader deletion; actual inspection references retain attached photos, and candidate eligibility is not a precise deletion deadline. Earlier own-request inspections stay readable after leaving membership, but new inspections require that requester to remain approved. Your personal JSON download includes inspections on your requests and inspections you wrote, with photo files separate; the community record includes its inspection fields. Havara cannot recall downloaded copies or photos already loaded on your device after deletion or a permission change.

Private board discussion. The console has a separate text thread for current approved community administrators, including management administrators assigned to the community and declarants with that role. Other members cannot read it. Havara keeps each message, its author account link, its community and its posting time. Posting and removal add activity records with the actor, community, message identifier and time, without the message text. The thread does not send notifications or feed community chat or search. You can remove your own message while you hold an administrator role. Removal erases its text and keeps a dated placeholder and activity record. Losing that role ends thread access and self-service removal. Deleting your account clears your author account link but retains the text, which may still identify you. Community deletion removes the thread. Your personal download includes messages you wrote, even after leaving; a current administrator's community download includes the thread. Removed text is absent from both downloads. Havara cannot recall copies someone already received. Backups follow the existing backup schedule. For a privacy request after losing access, contact [email protected]. Formal decisions belong in Meetings.

Committee appointments and content. Leaving a community keeps your account identifier in its committee appointment history, unlike Board seats. Rejoining requires a new appointment. Account deletion clears relational account, membership, creator and appointer links but leaves appointment titles, unremoved message text and PDFs with the community. Supabase Storage retains uploader ownership metadata while a PDF is stored. Other identifiers, titles, text, PDF contents and copies may identify you. Former member is a display label, not a promise of anonymity. Reapproval of the same membership can resume an unended current term; a new membership does not restore the old appointment or its name. Current appointees may erase their own message text or remove a file record; losing the appointment ends these controls. Any current administrator can remove a message or file by its activity reference without being appointed or reading it, including read-only. The dated placeholder and metadata-only audit remain. File removal clears its name, path and byte count and blocks new downloads, with physical cleanup pending the bounded orphan sweep. Active referenced PDFs remain after account deletion. Community deletion removes committee rows and leaves orphaned files for cleanup. Download your data before account deletion: your personal download includes your appointments, authored message/file records and committee-creation metadata, even after leaving, but no PDF bytes. Copies already returned or emailed cannot be recalled. Queued committee updates and private first-send times follow the existing email queue and account-deletion schedules. An unconfirmed or conflicting retry may still have been delivered. Backups follow the existing schedule. For removal after access ends, contact [email protected].

4. Timing, grace windows, and backups

It happens now, and there is no undo.

• Immediate, no grace window. There is deliberately no "deactivate first" or cooling-off period. Apple's guidance is explicit that temporary deactivation is insufficient, and Havara performs a true delete in the live database the moment you confirm.
• This is a one-way door. The two confirmation dialogs say so before you commit. If you want your data, export it first (Section 1).
• If you signed in with Apple, Havara asks Apple to end its access to your Apple ID. It does this as part of the deletion, using the token it kept when you signed in with Apple or, on iPhone, a fresh authorization from Apple, which Havara exchanges for a token it keeps until Apple answers. If you delete on an iPhone signed in to a different Apple ID, that authorization is for the other Apple ID, so Havara ends nothing and its record says so; remove Havara from your own Apple ID with the steps below. If Apple cannot be reached, Havara tries again with that token for up to 24 hours. If Havara holds no token, the web console and the Android app say so before you confirm, and on iPhone, if you close Apple's request or it fails, the message after the deletion says so; each tells you how to remove it yourself: on your iPhone, open Settings, your name, Sign in with Apple, Havara, and choose Stop Using Apple ID; if they cannot check, they give the same steps in case you signed in with Apple. Your account is deleted either way. Havara keeps a record that it asked Apple, with your deleted account's identifier, whether it worked and when; the Apple token and your Apple identifier are cleared from it when Apple answers, and within about a day at the latest. The entries Havara keeps to limit Apple sign-in token requests are erased with your account.
• Backups. Copies of the live database in our infrastructure provider's routine encrypted backups expire on that provider's backup-rotation schedule rather than instantly. The provider takes a daily backup and keeps each one for 7 days, so your deleted data stays only in the backups taken before you deleted it, until they expire about a week later.
• Case and request photos follow within about two days. Photos on violation cases about you, and photos you attached to architectural (ARC) requests and resident requests, are deleted from storage by a server job that runs when an account is deleted and again every day, so they are normally gone within two days. Until then no screen in Havara shows them, though your community's board administrators can still technically retrieve resident-request photos.
• Accommodation request documents follow within about two days too. The same job deletes the files you attached to accommodation requests. Unlike resident-request photos, your community's administrators cannot retrieve them in the meantime: they can open a document only while it is attached to a request, and the request and its document records are gone the moment your account is.
• Already-delivered notifications and emails (e.g., push previews on neighbors' devices, invitation emails you sent) cannot be recalled.

5. What deletion does not do

Honest limits.

• Deletion does not recall a CSV or printed/PDF board report already obtained by a community administrator. Havara keeps no report file. A fresh report reads the source records under their existing deletion rules, with unavailable names labelled accordingly; names typed into retained titles are still text. Report filters are not stored, and unused verified file readiness expires after one minute or clears when context, filters or focus change. A later server-only role change cannot recall already returned browser data. The existing activity log retains the preparation kind/time with its actor anonymized on deletion, and does not prove a file was saved.

• It does not remove content other members posted about shared community matters (report concerns to your community's administrators or via in-app content reporting).
• It does not dissolve community records about your unit (Section 3). Those belong to the HOA's own governance record.
• It does not reach crash reports already sent to Sentry. When the app hits an error it sends the error, the stack trace and your account's user id to Sentry so we can fix it (see the Privacy Policy, Section 7). Every report also carries the approximate location (city, region and country) Sentry works out from the IP address the report came from, and depending on the app version a report can carry that IP address as well. Those events sit in Sentry's systems, not ours, and the deletion above is a database operation that cannot reach them; they expire on Sentry's own schedule, within 30 days on our current plan and 90 days at the outside, backups included. If you want them erased sooner, write to [email protected] and we will do it by hand. From the first native-crash store build, reports also carry an installation identifier, which can be their user id while signed out, and the device diagnostic context listed in Privacy Policy Section 3. iPhone reports also carry a device-and-app hash in the app context, signed in or not. They do not include message content, email, phone numbers or push tokens.
• It does not reach our servers' request logs. Supabase, which runs our servers, logs each request the app makes, with your IP address, the approximate location worked out from it (city, region, postal code and country) and, while you are signed in, your account's user id; account events such as signing in are logged with your email address (see the Privacy Policy, Section 3). Deleting your account cannot edit those logs. They expire 7 days after each request.
• It does not remove photos on a violation case about you, or photos you attached to architectural (ARC) requests or resident requests, at the same moment as the rest. The cases and requests themselves are deleted immediately; their photo files follow within about two days (Section 4).
• It does not remove Havara from your Google Account. If you signed in with Google, Havara's servers keep no Google token, and Havara does not ask Google to end its access, so Havara stays on your Google Account's list of connected apps until you remove it in your Google Account settings. On your phone, Google's sign-in library keeps your Google sign-in until you sign out of Havara there; on iPhone that includes a refresh token, which is never sent to Havara. Deleting your account in the app signs you out on that phone, which clears it; deleting your account from the web console does not. After a console deletion it stays until someone signs in to the app on that phone again and signs out, or until the app is removed. On iPhone, removing the app may not delete it; Google's library then deletes it the first time the reinstalled app starts a Google sign-in or a sign-out.
• It does not prevent you from creating a new account later, but Havara communities are invitation-gated, so rejoining a community requires a fresh invite or approved join request.

Requests to join without an invitation code

Deleting your account also deletes your no-code requests to join, including any submitted home address and optional unit still awaiting review, and their successful-submission ledger entries. You can instead withdraw a pending request without deleting your account. Approval or decline removes the submitted address and unit even if you keep the account. The registered home assigned to an approved membership is an existing community record, not a copy of the address you typed; it follows the existing home and membership deletion rules. Audit history follows the existing audit rules and does not contain the submitted address or unit.

Your personal-data export includes your own still-held request fields and successful-submission times. This disclosure concerns the unreleased request flow; publication and the October 30 effective boundary remain gates before address collection.

Optional product analytics

Havara's optional PostHog product analytics is currently switched off in the phone app and console. Nothing is sent. Activation is planned for a date at least 30 days after the customer-admin notice is sent; that date has not been set. Publication, the notice, a recorded Privacy Policy Section 17 materiality decision and any required acceptance, verified project privacy settings and retention, and the full notice period must precede key placement. The Subprocessor List remains Conditional until a separate update after the first verified event.

Once activated, it is off unless you turn it on in Profile or Your account. It sends only the event names and scalar properties in the permitted event list below, a random installation identifier and a timestamp. It is not linked to your account: no account, community, conversation or content identifier, names, contact details, message text, page queries or fragments are sent. There is no identification call, person profile, autocapture or replay. PostHog receives the connection IP address; before activation its project must be set to discard client IP data and disable GeoIP enrichment. It must not infer a location from these events. This does not change Sentry, Cloudflare or Google's separate processing.

The phone keeps the installation identifier with a local account marker in device storage. The console uses session storage, with a tab-memory fallback. The account marker never leaves the device. The identifier is removed on sign-out, account change, consent withdrawal and confirmed account deletion, then recreated on the next permitted send. A session restore for the same account keeps it. Demo and mock activity is never sent. Previously sent events cannot be located by account for export or deletion, because there is no account linkage or PostHog deletion integration. They expire under the project's retention setting, which is unknown until project creation and must be verified and published before activation.

Permitted events and properties (all other events and properties are dropped):