Deactivation and permanent deletion are two different exits

What it is

Exit has at least two meanings: deactivation — the account becomes invisible to others, data is retained, restoration is instant — and deletion — data enters a purge pipeline and will not come back. They serve different user states (leaving for now versus leaving for good) and are different design objects. Blurring the semantics — a "delete" button that deactivates, a deactivation that quietly deletes after a timeout — mishandles the exit intent: either error hands the user an outcome he did not choose.

Why it happens

The two exits sit at different points on the reversibility spectrum. Deactivation's value is the cooling-off: a sizable share of exit decisions are state-bound — post-conflict impulse, momentary frustration — and a reversible design lets those decisions be slept on and undone, while immediately cutting off present use (invisible, unable to log in): protection and freedom at once. Deletion's value is finality: for the user who is certain, reversibility itself is a burden — a suspended account means data processing without end and an unresolved digital identity. Cooling-off length follows the time structure of impulse decay: exit impulses share the shape of use impulses, with days-to-two-weeks covering the great majority of state-bound decisions; silence past the window counts as confirmation, which is where undo-window conventions come from.

Where it stops holding

A cooling-off period must not decay into covert retention: sending recall notifications during deactivation ("someone tagged you," "friends are looking for you") turns reversibility into a win-back channel — protection sliding into manipulation. Deletion's finality is bounded by statutory retention duties: transaction and compliance records have independent retention periods that outrank user instructions, so deletion promises can cover only unencumbered data — a boundary that must be stated, not folded into a blanket "we delete everything." Anonymization in place of deletion (retaining de-identified statistical use) is accepted in most jurisdictions, but it sits at a distance from what users understand "deleted" to mean; the wording must keep them distinct.

Applying it

Two actions, two entry points, two names: offer deactivation and deletion separately, each stating its semantics — whether data is kept, for how long, whether restoration is possible, whether one remains visible to others. Deletion carries its own cooling-off: revocable for a few days after submission, executed at expiry, with zero recall notifications and zero retention pushes during the window. Deactivation defaults to silence, with a configurable retention period and one expiry question — convert to deletion or restore — handled by the preset if unanswered. Disclose legally retained data as a list of categories, periods, and usage boundaries, never merged into "deleted." Verification: watch how exit intent splits between the two semantics and the cooling-off revocation rate — a high revocation rate means the entry misled hesitators into deletion; track revoked users' satisfaction to confirm the window truly protects state-bound decisions.

Related

• Same group: P3.10.1 The cost of leaving includes the loss of social ties · P3.10.2 The count and wording of retention steps decide whether they inform or obstruct · P3.10.4 Data processing that continues after exit makes the exit incomplete
• Adjacent: P3.05.2 Data portability is a precondition of exit · P3.06.2 Recall unrelated to user goals is attention taking
• Search terms: account deactivation · right to deletion · cooling-off period