Ask us for your data. There's almost nothing there.
European and Swiss law gives you a quietly radical right: any company must, on request, hand over the personal data it holds about you. When journalists exercise it, the results are usually grim reading. In 2017, a reporter asked a dating app for her file and received eight hundred pages: every message, every match, every location, years of inferred preferences.
This series has spent months claiming our server holds almost nothing about you. That right turns the claim into something better than a promise: an experiment you can run yourself. Settings, Personal data, “Download my data”. No form, no waiting period, no human reading your request. Here’s what comes back.
The server’s entire file on you
A small file you can read in a minute, end to end. Your account row, when it was created, which verified channel it uses. The list of your registered devices. Your subscription receipts, and, if you’re a guardian, the child-consent receipts. And then a few lines of deliberate comedy, entries that read like: “an encrypted blob of 48 KB that we cannot read”, your backup and your avatar, described from the outside because describing them is all we can do.
No position, past or present. No place, no name of a place. No trip. Not the name of a single person you know, or who knows you. Not because those lines were redacted for the export, but because the rows don’t exist.
An export that doubles as an audit
Let’s be precise about what this proves, because it’s the whole point. Data protection law binds a company for the data it holds. A company with your life on its servers can write any privacy policy it likes; its export will still be its confession. Ours is nearly empty for one reason only: the architecture this series described, positions that expire in transit, contacts that never upload, circles the server can’t reconstruct, billing kept as bare receipts.
We didn’t build the empty export; we built the system, and the empty export is what honesty looks like when you print it. Any Fenzly user can pull it in ten seconds, today, and check this article against reality.
The full version lives with you
Your data does exist, in exactly one place: your phone. So next to the server export, the same screen offers a local export, built on-device: a readable, compressed JSON of your places, your trips, your timeline and your settings, with your position history included if you toggle it on. One deliberate exclusion: your circle members’ data, their positions, the chat threads, isn’t yours to walk away with, so it stays out, just as your data stays out of their exports. And for a single outing, the GPX export remains the sport-friendly route.
One distinction matters enough to state plainly: this export is a copy to read, not a key to return. It can’t be loaded back into Fenzly, and it can’t recreate an account. The only thing that restores an account is your encrypted backup, which carries what no readable file ever could, your encryption identity. Export to keep an archive; back up to be able to come back.
Leaving is a feature too
The same screen holds the other right, done with the same seriousness: deletion. A confirmation code to your verified channel, and it’s immediate, automated, final, no retention specialist calls you back. Your account and keys vanish from the server, your devices wipe their local data at the next launch, you disappear from your circles’ maps, and, read this twice, your backups are erased too, including the key share that made the automatic backup readable. Nothing can be restored afterwards.
Let’s close the loophole hope looks for: there is no way back. Not for us, there’s no master key and now no account either, and not for you, because the readable export you kept is an archive, not a backup; it cannot rebuild what was deleted. Returning to Fenzly means a brand-new account, a new identity your circles would have to re-invite, with none of the old history. Deletion here means what the word says.
Because that’s unforgiving, the app offers to export your data first, and a failed export never silently proceeds to deletion. If you’ve lost access to the app entirely, a page on this site does the same job. Two honest notes: deleting your account doesn’t refund a running subscription, cancel it in the store first; and if you’re the sole guardian of a child in a circle, deletion is blocked until another guardian takes over, that’s protection, not friction.
The honest limits
Three things survive a deletion, and you should know them. A minimal tombstone marker stays briefly so your own signed-out devices can learn they must wipe, it identifies no one to anyone else. Your subscription history lives in Apple’s or Google’s systems under their rules, not ours. And the envelopes you already sent, the positions and messages your family received, live on their phones: you can delete your account, not their memories. That last one isn’t a flaw of Fenzly; it’s how sharing works, anywhere.
The best proof of this post isn’t the post. It’s the button. Go press it.
Still ahead in this chapter: the SOS button, once it has earned its stripes in our field tests, and locating a child without putting them under surveillance.