User data deletion
Last updated: July 18, 2026
You can permanently delete your overads account and the data attached to it at any time, without asking us. This page explains where that control lives, what the system actually does when you use it, what we cannot delete, and how to reach us if you have lost access to your account.
Delete it yourself
Deletion is self-serve and takes effect immediately. You do not need to contact us, and we do not review or approve the request. There are two controls, depending on how much you want gone.
Delete your whole account
In the dashboard, go to Settings, then Profile, and use the Delete your account control. If your account has a password, you re-enter it to confirm. Accounts created by signing in with Google have no password to re-enter, so for those the confirmation is the signed-in session itself. This removes your user record and every workspace you own, including workspaces that have other members: they lose that workspace too, so transfer ownership first if it should outlive you. Workspaces where you are a member but not the owner keep running without you.
Delete a single workspace
Go to Settings, then General, and use the Delete workspace control. Owners only. You type the workspace name to confirm. This removes the workspace with its members, integrations, campaigns and metrics, and leaves your personal account intact.
What happens on deletion
This is what runs when you delete your account, whether you do it from the dashboard or ask us to do it for you. Deleting a single workspace is a narrower operation, described below the list.
1.Platform authorizations are revoked first
Before anything is deleted we walk every OAuth connection in the workspaces you own. For Meta, Google Ads and Google Search Console we call the provider's own revoke endpoint, so the authorization is torn down on their side and not only on ours. LinkedIn, X and Snapchat publish no revoke endpoint, so for those we drop the grant we hold. A revoke that fails is logged and never blocks the deletion.
2.Encrypted tokens are deleted from the database
Your OAuth tokens live in our database as AWS KMS ciphertext, bound to your workspace by an encryption context. Deleting the connection rows removes the only copy we hold. To be precise about what KMS does here: the key never stored your tokens, it only made them decryptable, so the key itself is shared infrastructure and is not deleted with your account.
3.An audit entry is written before the delete runs
We record who requested the deletion, which workspaces it touched, and how many platform connections were revoked. Entries written against workspaces you owned are deleted along with those workspaces. Entries in workspaces that survive you remain as the record for the members still there.
4.Deletion is immediate, not queued
There is no soft-delete window and no restore. When the request completes, the rows are already gone from our primary database and neither you nor we can bring them back.
5.A confirmation email is sent
Once the data is actually gone we email you to confirm that the account and its data were deleted and that connected integrations were disconnected. We send it after the fact, so a confirmation always describes something that has already happened.
Deleting a single workspace does less than this
The workspace delete is one cascading database delete. It removes the workspace and everything attached to it, including its encrypted OAuth tokens, immediately and with no restore. But the three steps above that reach outside the database do not run on that path: we do not call the platforms’ revoke endpoints, no confirmation email is sent, and no audit entry survives, because the entry is written against the workspace that was just deleted and goes with it.
So if you want the authorization torn down on Meta’s or Google’s side and not only on ours, disconnect the integration first, in Settings, then Integrations. Disconnecting does call the provider’s revoke endpoint. Deleting your whole account does too. Deleting a workspace on its own does not.
If you cannot sign in
If you have lost access to your account, email privacy@overads.io from the address registered to the account, with the subject line Delete my account. We verify the request against your registered email and then run exactly the deletion described above.
We aim to acknowledge within two business days. Thirty days is the outside limit our privacy policy sets for responding to a rights request, not the expected wait: once we have verified you, the deletion itself is immediate.
What we delete
Deleting your account permanently removes the following from our database:
- Your account profile: name, email address, your bcrypt password hash if the account has one, and your Google sign-in identifier if you used one
- Every workspace you own, with its members, invites and settings, whether or not other people were in it
- OAuth grants for connected platforms: Meta, Google Ads, LinkedIn, X, Snapchat, and Google Search Console
- Synced ad accounts, campaigns, ad sets, ads and daily metrics
- AI suggestions and the outcome records behind your Daily Brief
- Social connections, scheduled and published posts, creative generations and CRM records in those workspaces
- API keys issued to those workspaces
- Audit log entries belonging to workspaces you owned
What we retain
Deletion is thorough but it is not magic. These things are outside what the delete control reaches, and we would rather name them than let you assume otherwise:
- Audit entries in workspaces you belonged to but did not own. They survive as the record for the members still there, with your user reference set to null.
- Payment records held by Stripe, our payment processor. We delete the Stripe customer and subscription identifiers stored on your workspace, but the invoice history stays in Stripe. Note that deleting your account does not by itself cancel an active subscription, so cancel it in Billing first.
- Your email address if you joined a platform waitlist. That list is stored separately from your account and is not touched by account deletion. Ask us and we will remove it.
- Records we are required to keep by applicable law or tax regulation, typically seven years.
Contact
For deletion requests and any other question about the data we hold on you: