If I delete my data from an app, is it deleted from backups too?

PursueUpdated 10 October 202611 sources

Short answer

Eventually, but usually not at the same moment. EU and UK law require erasure without undue delay, and the UK regulator, the ICO, says backups count but may be put 'beyond use' until they are overwritten; Google Cloud commits to deleting customer data within about six months, and some backups are locked so that no one can delete them early.

01What the law requires

Under the GDPR, a company must erase personal data 'without undue delay' when, for example, consent is withdrawn; the article sets no day count and does not mention backups[1]. It must tell you what it did within one month, extendable by two months for complex cases[2].

The UK regulator is explicit that erasure covers backups, and that data which can't be overwritten at once must be put 'beyond use' until it is, with the person told clearly what will happen[3]. In Türkiye, requests must be concluded within 30 days, and companies with a retention policy must destroy data at least every six months[4]. On iPhone, apps that let you create an account must let you delete it inside the app[5].

02How backups actually work

Google Cloud describes a staged process that ends with a commitment to delete customer data within about six months, as backups expire on their normal cycles[6]. Microsoft keeps deleted backups recoverable for 14 days by default[7]. Some backups are deliberately locked: AWS and Microsoft offer write-once storage that no one, not even the provider, can delete before its retention period ends[8][9].

There is a cleaner way: encrypt each person's data with its own key and destroy the key. NIST recognises this 'cryptographic erase', and once a key is gone, data encrypted under it can never be read again, in every copy[10][11].

03What this is not

This is a summary of public rules and documentation, not legal advice. Laws and provider practices change, and how a rule applies to a particular company is a question for a lawyer.

Something to try today

Before you trust an app with personal data, look for two answers in its privacy policy: how long backups are kept after you delete your account, and whether it sells data in any form, including 'anonymous' or pooled.

Pursue

How Tre-Up approaches this

Tre-Up's policy is that it does not sell your data, not personal, not anonymous, not pooled. Our working design, still a hypothesis, is to stop all use of your data the moment you delete it, purge backups on a stated schedule, and move toward a key per person so deletion reaches every copy.

Tre-Up is an iOS app in development. Pursue is the AI inside it. This note describes research and design intent, not results from the app. Nothing here is medical advice.

Sources

Summaries are written in our own words from each source's abstract, public record or official text. Follow the link to read the original. How we write these notes

  1. 1.European Union (2016). General Data Protection Regulation, Article 17: Right to erasure.Our summaryEuropean Union
  2. 2.European Union (2016). General Data Protection Regulation, Article 12(3): Time limits for responding to requests.Our summaryEuropean Union
  3. 3.UK Information Commissioner's Office (current guidance). Right to erasure (UK GDPR guidance).Our summaryUK Information Commissioner's Office
  4. 4.Turkish Personal Data Protection Authority (KVKK) (2017). Regulation on the Deletion, Destruction or Anonymization of Personal Data.Our summaryTurkish Personal Data Protection Authority (KVKK)
  5. 5.Apple (current guidelines). App Store Review Guidelines 5.1.1(v): Account sign-in and deletion.Our summaryApple
  6. 6.Google Cloud (current documentation). Data deletion on Google Cloud.Our summaryGoogle Cloud
  7. 7.Microsoft (current documentation). Soft delete for Azure Backup.Our summaryMicrosoft
  8. 8.Amazon Web Services (current documentation). AWS Backup Vault Lock.Our summaryAmazon Web Services
  9. 9.Microsoft (current documentation). Immutable vault for Azure Backup.Our summaryMicrosoft
  10. 10.U.S. National Institute of Standards and Technology (2025). SP 800-88 Rev. 2: Guidelines for Media Sanitization.Our summaryU.S. National Institute of Standards and Technology
  11. 11.Amazon Web Services (current documentation). Deleting an AWS KMS key.Our summaryAmazon Web Services

Keep reading

All notes
  1. 01Is there an app that notices when my day is slipping and suggests one next step?Tre-Up, an iOS app in development, is being built for exactly that, and it is not released yet: its AI, Pursue, is designed to notice when your focus or energy shifts and to answer with one small next step, one question, or nothing. Until it ships, your phone's focus modes and scheduled notification summaries cover part of the job.Timing and receptivity

Tre-Up is built on this research.

Pursue, the AI inside Tre-Up, is designed to notice when your day starts to slip and offer one small next step. The iOS app is in development. Invitations go out in small groups; leave your email and we will contact you when yours is ready.

Your email is used only for your invitation and important product updates. It is never sold. Unsubscribe at any time. Privacy policy