What Sign-Out, Account Deletion, and Project Deletion Actually Remove

Sign-out, account deletion, and project deletion are three different operations. Sign-out switches the session and clears the local guest environment. Account deletion freezes and verifies an ownership scope for the current Apple identity before removing account-side records. Project deletion is limited to the selected project and its related media cleanup; it does not change the account session. Before asking what was deleted, first identify which operation was actually performed.

The same word, “delete,” reaches different data scopes from different entry points. The result of one path should not be applied to the other two.

Sign-out: account-cloud rows stay, while the local guest store is cleared

The sign-out path first quiesces current data work, handles the sign-in credential state, and only then clears the guest store. Its important boundary is two-sided: sign-out does not delete rows from the account cloud store, but it does clear the local guest-store entities and physically removes guest media and continuity-library cover files, leaving only the fixed guest root.

The order matters. Credential finalization occurs before guest cleanup. If the earlier sign-out step fails, guest cleanup does not proceed; the UI asks the user to retry and the session state is not changed. Therefore neither “sign-out deletes nothing” nor “sign-out deletes the account’s cloud data” describes this path correctly.

Sign-out does not delete account-cloud rows, but it does physically clear the local guest data environment and guest media files.

Account deletion: freeze the scope, compare it again, then finish the session

Account deletion follows a separate path. It first freezes the media scope owned through four relationship paths for the current Apple identity. It then clears the guest store, writes a media-cleanup journal, and re-fetches the target set with the same ownership conditions. If the re-fetched set does not match the frozen set, the operation errors and rolls back rather than deleting a scope that cannot be reconciled.

Only after the set comparison succeeds does the flow remove account-side media and database rows, followed by session finalization and settings cleanup. The code establishes what this device removes from its account data environment; it does not establish when another device or the cloud reaches the same state.

Account deletion also does not revoke the external Apple sign-in authorization. The current code does not perform that revocation; the settings UI can only direct the user to system settings for that separate action. Deleting account data therefore should not be described as a one-step revocation of every external authorization.

Project deletion: remove one project without changing the account session

Project deletion is scoped to the selected project. The app freezes media paths related to that project, enters the database-commit phase, and only after the project graph has been committed as deleted can the cleanup journal advance to physical media-file cleanup. The target is the project and records reachable beneath it; this operation does not sign the user out or change cloud sign-in state.

Project deletion has an explicit cleanup phase sequence: prepare the journal, mark database commit in progress, commit the database deletion, mark the journal as database committed, then clean media files. If the database commit has already succeeded but later file cleanup fails, the database is not rolled back to restore the project. The committed journal remains so a later launch can retry that confirmed file-cleanup work.

Project deletion is not a trash-bin operation. There is no current “recently deleted” or undo path. This describes how the deletion is executed on this device, not when other devices or the cloud will reflect the same state.

Why media cleanup needs staged state

Database cascade deletion does not itself remove filesystem media, so the cleanup system separates prepared, database-commit-in-progress, and database-committed states. A later launch is allowed to continue file cleanup only for a journal whose database deletion has already been confirmed. A journal that is merely prepared or mid-commit is not treated as proof that the database removal finished.

Only one non-draft cleanup journal can be active at a time. If an unfinished journal already exists, a new one is rejected rather than run concurrently. The implementation therefore should not be described as parallel deletion of several projects, and launch-time retry should not be described as a sweep that cleans every leftover file.

The boundary of this page

These paths show what this device’s database and media cleanup code does and where each operation stops on failure. They do not prove when other devices or cloud state become consistent, and they do not turn project deletion into a cross-device undo system or account deletion into an external authorization revocation.

Determining what another device sees after deletion requires separate device and synchronization verification. This page stays with the narrower question: what this device’s deletion paths actually remove.

FAQ

Does signing out delete account-cloud records?

No account-data deletion path is run by sign-out. Sign-out finalizes the session and clears the local guest environment and guest media, while account-cloud rows are not the target of that operation.

Why does account deletion compare the ownership set twice?

The flow freezes an ownership-derived target set first and then fetches it again with the same conditions. If the sets do not match, the operation rolls back instead of continuing with an uncertain deletion scope.

Does deleting a project also sign the user out?

No. Project deletion is scoped to the project graph and its media cleanup. It does not change account sign-in state.

Can a deleted project be restored from a recently deleted area?

There is no current trash, recently-deleted, or undo path. The cleanup journal coordinates committed database deletion with filesystem cleanup; it is not a recovery feature.

Axiom One LLC — SlateX. Figures current as of 24 September 2026.