Profile and account lifecycle
Change emails and names without losing anyone, let people export and delete their account themselves, and close unused accounts only after warnings.
- Required 2
- Recommended 3
Required
Keep the old email until the new one is confirmed
RequiredStore a new email address as pending until its owner confirms it. Keep sign-in, resets and notices on the old address until then.
Let people delete their account themselves
RequiredPut account deletion in settings, behind fresh proof of identity, and finish it within one month, as data requests sets. Say first what happens to the person's data and organisations.
Recommended
Let usernames change without breaking old links
RecommendedWhen a username or organisation slug changes, redirect the old address to the new one. Keep the old name reserved for at least 90 days.
Let people export their data themselves
RecommendedOffer a download of a person's data from settings, in JSON or CSV, ready within 24 hours.
Warn before closing inactive accounts
RecommendedSet a written inactivity period for free accounts, such as 24 months without sign-in. Warn twice by email, then delete or anonymise the account.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers accounts playbook: https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle.