How to delete your Xircuit account

You have the right under Article 17 GDPR to ask us to delete your Xircuit account at any time. This page explains how to start the deletion, what we delete, what we keep and why, and how long it takes.

The deletion runs in two stages: as soon as you confirm the request, the account is scheduled for permanent deletion 30 days later. During that window you can sign back in and cancel the request — after the window closes, the personal data we control is irreversibly removed and cannot be restored.

From inside the app

The easiest way to delete your account is from within Xircuit itself:

1. Open the Xircuit app or sign in at app.xircuit.com. 2. Go to your Profile. 3. Scroll to the "Danger zone" section. 4. Choose "Delete my account". 5. Type DELETE into the confirmation box to acknowledge that you understand the action is irreversible after the grace period. 6. Confirm.

We will email you to confirm that the request has been received and to give you a one-click cancellation link that works even if you can no longer sign in.

If you can't sign in

If you have lost access to your account and cannot sign in to start the deletion yourself, write to hello@threebit.io from the email address that is associated with your Xircuit account. We will verify the request manually and delete your account within 30 days.

Please include enough information for us to identify the account (the email address you used to register, the organisation name if you joined one, and the approximate date of last use).

What happens next

Once you confirm the request, your account enters a 30-day grace period. During this time:

- You can sign back in and cancel the deletion from your Profile. - You can also cancel it by clicking the cancellation link in the confirmation email — this works without a sign-in, so it still works if you have forgotten your password. - The account remains usable. You will see a banner reminding you that deletion is scheduled and showing the exact date.

At the end of the 30 days, an automated job permanently removes the personal data we control. We send a final confirmation email to the address on file once the deletion has completed.

What we delete

When the grace period expires, we permanently delete the personal data we control:

- Your account identity (name, email address, authenticated user identifier, language and theme preferences). - Your personal workout history (sessions, sets, repetitions, weights). - Body metrics you have entered (weight, body composition, measurements). - Achievements you have earned. - Training, nutrition and medication plans you own. - Files and images you have attached to your own records. - In-app preferences and notifications.

This data is removed from the live database. Backups taken before the deletion are kept for at most 30 additional days and then rotated out; restoring a pre-deletion backup is reserved for disaster recovery and never re-introduces a deleted account.

What is kept and why

Some records are not deleted because we are not the controller of them, or because the law obliges us to keep them. We detach these from your account (so they can no longer be linked back to you through Xircuit) but the records themselves remain:

1. Records owned by clinics, gyms or studios you used. If you were a patient at a practice, a member at a gym, or a client at a studio, the appointments, treatment notes, medical records and insurance claims linked to that organisation belong to the organisation as the controller. They keep those records under their own privacy policy and under the statutory retention rules that apply to them — most notably § 630f BGB, which obliges medical professionals to keep patient files for at least ten years after the last treatment.

2. Billing and tax records. Where you have paid for the Service, German commercial and tax law requires us to keep the related invoices and accounting records for ten years (§ 257 HGB and § 147 AO). These records contain only the data necessary for accounting and tax compliance.

3. Anonymised audit and security traces. Server-side audit logs that record access to sensitive data (e.g. PHI access) are kept for security forensics, but every entry that previously identified you is replaced with an opaque tombstone identifier so the trace can no longer be associated with you personally.

Questions?

If you have any questions about this process, write to hello@threebit.io.

The broader context for how we handle your personal data, the contractual terms that govern your use of the Service, and our provider identification are covered by our Privacy policy, our Terms of Service and our Site notice — all linked from the legal hub at /legal.