Deleting your data

BanditKin is end-to-end encrypted. Your circle's private content (locations, messages, voice clips, and Places) lives on our relay only as ciphertext, which we cannot read, and on your circle's paired devices. The relay also holds operational metadata that it can read, including random circle and device IDs, timestamps, battery and online flags, and your circle's cloud plan status. Our privacy policy lists all of it. You can delete your data at any time.

Delete your device's data (in-app)

1. Open BanditKin on the device you want to remove.
2. On the Status screen, tap Reset this device and confirm.
3. BanditKin removes this device from the group on the relay, then erases the app's data on this phone and returns it to a fresh setup.
4. If the relay can't confirm the removal, nothing is erased yet. You can retry, or choose Erase phone only; the relay may then keep this device's encrypted records until a group admin removes it.

Reset this device removes this device from the group and, after the relay confirms removal, erases its local BanditKin data, keys and settings. Shared Places remain available to the group, including Places this device created. Other members' phones are not wiped. If relay removal cannot be confirmed, the app offers retry or an explicitly disclosed phone-only erase; phone-only erase does not confirm removal of the relay copy.

The group founder can choose Delete entire group, type the group ID, then select Delete group. After confirmed relay deletion, BanditKin resets the initiating phone. Group syncing stops for other members, but copies already on their phones are not wiped remotely.

Resetting a device or deleting a group does not cancel a Google Play subscription. Cancel it in Google Play to stop future renewals. Resetting the founder's phone also erases its group-admin key; without another copy, the founder loses the ability to delete the entire group.

Or request deletion by email

Email privacy@banditkin.com with enough detail to identify the device or circle, and we will delete the associated data from the relay.

What is deleted

For a reset device: its location and location history, the text and voice messages it sent, and the device's metadata (battery/online status, device identifiers) held on the relay.

For a deleted circle: all of that for every member, plus the circle's Places, settings, credentials, wake-up tokens, and purchase records (product, status, and the ownership digests that link a purchase to the circle).

What is kept, and for how long

Location history is retained only for the app's history window and then automatically discarded. After a device is removed, its stored ciphertext is deleted from the relay. If your circle self-hosts the relay, all data lives on hardware the operator controls and is deleted there.

Three things outlast a deletion on our hosted service:

• Backups. Fly.io volume snapshots keep deleted data for up to five days, then expire. Circle content in a snapshot stays end-to-end encrypted.
• Deletion receipts. To finish an interrupted device removal or confirm a lost deletion response, the relay keeps a hash of the credential used, the random circle ID, an expiry time and, for a device removal, the random device ID. These expire after one hour and cannot restore access.
• Refund records. If a purchase was refunded with access removed, or charged back, a hash of that purchase and the refund time are kept indefinitely so the refunded purchase can't turn service back on. No circle identifier is attached.

Questions: privacy@banditkin.com

Community reports

The Flock cameras and U-turn crossovers you report or confirm are public road-feature data. Reports use a pseudonymous handle that changes by feature type, area, and week. Confirmations use a handle that stays the same for one feature, so repeat votes can be spotted. No name or circle credential is attached, but a report can sit close to where you were. Reports are not deleted with your circle. To ask about correcting or removing one, email privacy@banditkin.com.