---
title: "Full account erasure (UK GDPR Art. 17)"
method: DELETE
path: "/api/v1/users/me"
tags: ["privacy"]
---

# Full account erasure (UK GDPR Art. 17)

`DELETE /api/v1/users/me`

## Request

- Base URL: `https://yondry.app` (the document declares no server; this is the origin it was published from)
- URL: `https://yondry.app/api/v1/users/me`
- Auth: HTTP bearer

Permanently erase all personal data and anonymise the user record.

Immediate effects:
- All Place, Visit, and GeneratedPlan data deleted (preserve_edited=False).
- All refresh tokens revoked — existing sessions stop immediately.
- Sensitive fields nulled: home_lat/lon, location, name, avatar.
- Email scrambled to 'deleted-{uuid}@deleted.invalid'.
- is_deleted=True, is_active=False.

The User row itself is retained for audit purposes.
Access tokens (stateless JWTs) become invalid because get_current_user
rejects is_deleted=True accounts.

## Response `204`

Successful Response

---

[API](https://skmtc.dev/yondry/apis/yondry-api.md) · [All operations](https://skmtc.dev/yondry/apis/yondry-api/llms.txt) · [OpenAPI document](https://skmtc.dev/yondry/apis/yondry-api/revisions/d2c213cea95b?raw)