Your Data

This page covers the life cycle of your data on Nitrate: how you get a copy of it, what happens when you delete your account, and exactly how long anything sticks around. It's the companion to the Privacy Policy.

Download everything, any time

Settings → Your data → Download my datagives you a zip of JSON files containing everything your account has generated: profile info, every diary entry (with ratings, reactions, tags, rewatch flags, and tagged places), reviews, comments you've written, lists and their contents, your watchlist, and who you follow and who follows you. No waiting period, no email dance, no reason needed. It's your data.

Deleting your account

Settings → Your data → Delete my account. You'll be asked to type your username and re-enter your password — deletion can't be triggered by a stray click or a hijacked browser tab.

What happens the moment you confirm:

Immediately:you're signed out everywhere, the account can no longer log in, and everything tied to it disappears from the site — profile, diary, reviews, lists, watchlist, follows, places. Your comments in other people's threads show as "[deleted]" so conversations don't break.

For the next 30 days:the underlying data still exists in the database, invisible to everyone. Why not erase it instantly? A short legal-hold window: if the account was involved in something that requires investigation — abuse reports, a legal request — the data can still be produced during that window. There is deliberately no self-serve "undo"; the window exists for legal reasons, not as a recycle bin.

After 30 days: a scheduled job permanently and irreversibly erases everything — diary entries, reviews, comments, reactions, lists, watchlist, follows, sessions, reset tokens, uploaded avatar/banner images, and the account record itself. There is no backup copy we can restore your account from after this point.

Retention, item by item

Password-reset links: valid for 1 hour, single-use, and stored only as a hash. Used or expired tokens are cleaned up automatically.

Sessions: expire 30 days after login. Logging out deletes the session immediately; changing your password via reset deletes all of them.

IP addresses: used in-memory for rate limiting only; never written to the database, gone on restart.

Suspended accounts: if an account is suspended by moderation, its data is kept but hidden from the public while the situation is resolved. Suspension is not deletion — the 30-day purge clock only starts if the account is deleted.

Moderation records: reports and their resolutions are kept so moderation decisions stay accountable, but when a purged account goes, the references to it are blanked — no personal data remains in them.

Everything else (your diary, reviews, lists, and so on): kept for as long as your account exists, because it is the product. Delete the account and the schedule above applies.

Database backups

The database is backed up for disaster recovery (daily volume snapshots kept for about 5 days, plus occasional manual dumps). Deleted-then-purged data can persist in those backups briefly until they rotate out — that's days, not months, and backups are never used to resurrect deleted accounts.