Delete your data

Leave a group in the app

1. Open Probably and select the Friends tab.
2. Scroll to Leave group.
3. Confirm Leave.

This immediately revokes that membership's server access. Your own shared predictions remain as personal predictions on your device; content received from other members is removed locally. Leaving does not automatically erase contributions already shared into the group history. Push registrations for the departing identity are removed as part of leaving.

Export your current group data

In Settings → Your data, the group-data export contains current group metadata, your own membership profile, and only shared records whose authoritative author is your pseudonymous identity. It does not include other members' profiles, forecasts, comments, or stakes. Structured mentions are removed because they embed another member's profile, although free text you wrote can still name another person.

Delete your group data

1. Open Probably and select Settings.
2. Open Your data.
3. Select Delete my group data and confirm.

The operation permanently removes your membership row, every push registration for your pseudonymous user identity, and invites you created in the current group. The content payload of every shared record you authored is scrubbed. When you owned a shared prediction, the payloads of its attached forecasts, comments, and stakes are scrubbed too, including entries authored by other members, because their content cannot remain without its parent.

Block relationships involving your identity and reports you submitted are also deleted. If another member reported content you authored, the report's author identifier is cleared, its content snapshot becomes a privacy-removal marker, and moderator-event notes that may quote that content are erased. The remaining report status, reason, reporter-authored context, and audit timing may be retained while needed to document the safety review.

If other active members remain, the server keeps empty deletion tombstones so their devices can remove cached copies and do not re-upload erased content. These markers retain only routing and schema metadata: record type and UUID, change sequence, timestamps, schema version, and a fixed non-identifying nil value in the schema's required author field. They do not retain the original author UUID or the prediction, forecast, comment, or stake payload.

If this was the group's last active membership, the now-unused group and its remaining server records are removed too. If active members remain, their own predictions and contributions that do not depend on one of your predictions stay available to them.

This authenticated action covers the current group. It does not delete unrelated personal predictions stored only on your iPhone or copies already exported by a person. Your owned shared predictions are detached as personal journal entries on the requesting device; use the separate local-journal deletion if you also want those local copies erased. Contact mail@pmuench.com if the in-app operation fails, but do not include credentials or sensitive group content in the message.

Delete local data

In Settings → Your data, Delete all local journal data removes personal predictions, locally cached group predictions, histories, comments, reflections, stakes, and local credits from this device. Export a personal journal archive first if you may want the personal content later.

Local deletion is not server deletion. If you still belong to a group, the group membership, pending deletion markers, and Keychain credential remain so the app does not strand that membership or silently undo a pending shared deletion. Shared server records can therefore sync back later. Use Delete my group data as well when you want to erase the authenticated server copy.

Removing the app also deletes its SwiftData journal, subject to Apple's device and backup behaviour. The random device identity and group credential can remain in the iOS Keychain after uninstall so a reinstall can restore access on the same device. Personal journal archives do not contain that credential and do not transfer group membership. Use the separate membership-transfer action while both devices are available when you want to move group access securely.

Rights and response timing

The in-app result confirms whether the authenticated deletion request completed. Other privacy requests are handled within the period required by applicable law — ordinarily within one month under the GDPR. Complex requests may take longer where the law permits; if so, we will explain the extension.

For more detail, see the Privacy Policy.