Account Deletion Flow

Account Deletion Flow

REQUIRED in-app since 2022 if your app has accounts (5.1.1(v)). Settings → Account → Delete Account.

SwiftUI-style React Native flow

// app/(tabs)/settings.tsx
function DeleteAccountRow() {
  const router = useRouter();
  return (
     router.push('/delete-account')}>
      Delete Account
    
  );
}

// app/delete-account.tsx
function DeleteAccountScreen() {
  const [confirming, setConfirming] = useState(false);

  const handleDelete = async () => {
    Alert.alert(
      'Delete Account?',
      'This permanently deletes your data, subscriptions, and access. This cannot be undone.',
      [
        { text: 'Cancel', style: 'cancel' },
        { text: 'Delete', style: 'destructive', onPress: confirmDelete },
      ]
    );
  };

  const confirmDelete = async () => {
    setConfirming(true);
    try {
      // 1. Call server to hard-delete user record + revoke tokens
      await fetch('/api/account/delete', {
        method: 'DELETE',
        headers: { Authorization: `Bearer ${await SecureStore.getItemAsync('authToken')}` },
      });

      // 2. Revoke Sign in with Apple (server-side)
      // Server calls https://appleid.apple.com/auth/revoke with the user's refresh token

      // 3. Clear all local state
      await SecureStore.deleteItemAsync('authToken');
      await AsyncStorage.clear();
      // queryClient.clear()
      // useApp.persist.clearStorage()

      // 4. Sign out + navigate to auth flow
      router.replace('/sign-in');
    } catch (e) {
      Alert.alert('Failed', e.message);
      setConfirming(false);
    }
  };

  return (
    
      Deleting your account is permanent and immediate.
      You will lose:
      • All your data
      • Access to your subscription (no refund)
      • Sign in with Apple link to this account
      
        Delete My Account
      
    
  );
}

Server-side Sign in with Apple revocation

POST https://appleid.apple.com/auth/revoke
Content-Type: application/x-www-form-urlencoded

client_id=com.example.myapp
&client_secret=
&token=
&token_type_hint=refresh_token

ABSOLUTE NO

• Don't link to a website to delete account — must be in-app
• Don't soft-delete and call it deletion — Apple rejects
• Don't keep PII after deletion — must hard-delete

Reference

references/06-store-readiness.md

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: khadinakbarlabs
• Source: khadinakbarlabs/expo-mobile-app-builder
• License: MIT
• Homepage: https://khadinakbar.com

Install and usage instructions live in the source repository linked above.