Delete your account, for real

Settings → Profile now has a Delete account section. Type your email, re-enter your password, check the box, and we schedule a permanent wipe three days out. During the wait you're locked out of everything except export and logout, so you can take a copy of your archive before the clock runs out. Cancel any time before then — in the app or from the confirmation email — and we stop. After three days every document, OCR text, AI summary, and encrypted R2 blob is purged, your Stripe subscription is cancelled, your user row is gone. We keep one PII-free tombstone (a peppered hash of your email plus timestamps) so we can answer compliance questions like "did this account ever exist" without retaining anything else about you.