— Updated 2026-09-20

Delete Your Data

This page explains how to delete your data from the 1765 Sanctum app, published by 1765 Sanctum Co. (operated under 1765 Apparel Co LLC). If you can sign in, you delete the account yourself and we are not involved. The steps are below, along with exactly what is deleted, what is kept, and how long it takes.

Delete it yourself — no request, no waiting

If you can sign in, you do not need to ask us. Either surface runs the same deletion:

In the app: open Profile → Delete account. On the website: open your account page and choose Delete your account.
The screen lists, in plain words, everything that will be destroyed and everything that stays — including whether a live Brotherhood Pass or a Founding Brother seat will stop the deletion — before anything is set in motion.
Choose Email me a deletion code. We send a 6-digit code to the address you sign in with. It expires in 10 minutes. Nothing is deleted at this step.
Enter the code and confirm. The deletion runs immediately and every device signed in to that address is refused from that moment. There is no copy to restore.

The code goes to your mailbox on purpose: someone holding your unlocked phone still cannot delete your account without also holding your email.

You can also remove most data yourself, immediately, inside the app without deleting the account: open any Family Altar section to change or clear what you entered, and use the Confession Vault's own controls for anything stored there (see below).

If you cannot sign in — email us instead

Email will@1765sanctum.com from the email address you use to sign in to the 1765 Sanctum app, with the subject line "Delete my data."
Tell us whether you want your entire account deleted, or only specific data removed (for example, only your Family Altar details) while keeping your account.
We confirm by reply and complete the deletion within 7 days of your request.

If you hold a Brotherhood Pass, close it first. Billing lives at Stripe, not with us. While a subscription is still live, Stripe keeps telling us about it, and a renewal notice arriving after a deletion would rebuild a membership record for your address. Cancel the Pass (or tell us to treat your request as ending it), and we complete the deletion once it is closed. We will say so in our reply either way. The self-service screens refuse the same way and for the same reason: while your card can still be charged they will not erase the account, and they say so and change nothing rather than leaving you half-deleted and still billed.

What gets deleted

Your account — your email address, any password you set (we hold it only as a salted hash), and your membership record.
Your sign-in sessions. We store sessions under a one-way hash of the session token, so we cannot look yours up by name. Instead, the deletion records a permanent marker against your address, and from that moment every session created before it is refused — on every device, immediately, without waiting for it to expire.
Your Family Altar — your wife's and children's first names, children's ages and baptismal saints, sacrament dates, and your Three-Generation Map entries.
Your tool progress — every record stored under your address: Rule of Life, Priest of the Home, Navigating Annulments, Fight Club, The Watch, Hearth, Campaign, Catechist, the Scriptorium reading ledger, the consecrations and devotions, the Examination's dates and streak, and your formation streak.
Your place in a squad. If you belong to a Muster squad, your entry comes out of that squad's record — your address, your handle and your weekly check-ins with it. Your brothers keep their own. A squad left with nobody in it is deleted.

What is kept (and for how long)

Payment records. If you ever subscribed to the Brotherhood Pass, billing records are held by our payment processor, Stripe, which may retain transaction records as required by law (tax and accounting). We never store your card number. These records are held under Stripe's terms, not on your app account.
Anonymous server logs. Our host, Cloudflare, keeps standard, short-lived server logs that are not linked to your identity once your account is deleted.
Email delivery logs. Resend delivers our sign-in links and keeps its own sending log, which includes the address a message went to. Its published retention on the standard plans is 30 days (checked 8 September 2026). We do not control that window and cannot clear it for you.
One anonymous marker of the deletion itself — a one-way hash of your address and the date. It cannot be turned back into your email. It exists so that a device still signed in is refused, and so we can show the deletion was actually carried out.
Your Sanctum Dispatch subscription, unless you unsubscribe. The newsletter list is held by our newsletter provider and is not part of your account, so deleting the account does not take you off it. The delete screen offers to ask the provider to remove you, but we cannot do that removal ourselves today and the screen says so when it cannot — the unsubscribe link at the bottom of any Dispatch email always works.
Nothing else tied to you is kept. Deletion is permanent — we cannot recover it afterward.

The Confession Vault never reaches us

Anything you write in the Confession Vault is encrypted on your own device (AES-GCM, under a PIN only you know) and is never transmitted to us or anyone else. There is nothing for us to delete because we never receive it — which also means no deletion we perform on our side can reach it.

It lives on the device that wrote it, and only there. Deleting your account from a device erases the Vault on that device as part of the same step, and the screen names anything it could not remove rather than telling you it is all gone. Uninstalling the app, or clearing the site's stored data in your browser, erases it too. A Vault written on a second phone stays on that second phone until you delete it there as well.

Questions

Email will@1765sanctum.com and we'll help. See also our Privacy Policy.

Altar. Arms. Allegiance.