Guideline 5.1.1(v): adding in-app account deletion to an Expo and Supabase app

What Apple actually checks

Apple’s support page, Offering account deletion in your app, spells out what passes review:

• Delete, don’t deactivate. “Offer to delete the entire account record, along with associated personal data… only offering to temporarily deactivate or disable an account is insufficient.”
• Easy to find. Typically in the app’s account settings.
• No support flows. Apps outside highly regulated industries “should not require people to make a phone call, send an email, or go through other support flows.”
• Confirming is fine. You can re-authenticate or ask for confirmation, but making deletion “unnecessarily difficult” fails review.
• Sign in with Apple. Apps that support it “should use the Sign in with Apple REST API to revoke user tokens.”
• Subscriptions. Tell people billing continues through Apple and ask them to cancel before deleting.
• It can take time. A manual or slow process is acceptable if you say how long it will take and confirm when it’s done.

The rejection usually reads: “The app supports account creation but does not include an option to initiate account deletion.”

Why AI-built apps miss it

Builders generate the sign-up screen because it’s part of the preview. Deletion needs a server-side step, because the client isn’t allowed to delete users. So it’s usually missing, or it’s done the dangerous way, with the service role key shipped inside the app.

The fix: an Edge Function that deletes the signed-in user

Supabase’s auth.admin.deleteUser “requires a service_role key” and “should only be called on a server.” Put it in an Edge Function. The pattern below follows Supabase’s current Edge Function auth docs: the function only runs for a signed-in user, and uses the admin client to delete that user and nobody else.

// supabase/functions/delete-account/index.ts
import { withSupabase } from "npm:@supabase/server";

export default {
  fetch: withSupabase({ auth: "user" }, async (_req, ctx) => {
    const userId = ctx.userClaims?.id;
    if (!userId) return Response.json({ error: "unauthorized" }, { status: 401 });
    const admin = ctx.supabaseAdmin;

    // 1. Files block deletion. This assumes each user's files live under `${userId}/`.
    const { data: files } = await admin.storage.from("avatars").list(userId);
    if (files?.length) {
      await admin.storage.from("avatars").remove(files.map((f) => `${userId}/${f.name}`));
    }

    // 2. If the app supports Sign in with Apple, revoke the user's Apple token here.

    // 3. Hard delete. Tables that reference auth.users with ON DELETE CASCADE go with it.
    const { error } = await admin.auth.admin.deleteUser(userId);
    if (error) return Response.json({ error: error.message }, { status: 500 });
    return Response.json({ ok: true });
  }),
};

In the app, call it from a Delete account screen after a confirmation step, then sign out:

const { error } = await supabase.functions.invoke("delete-account");
if (!error) await supabase.auth.signOut();

functions.invoke sends the signed-in user’s session token automatically, which is how the function knows whose account to delete.

Make the database follow

Supabase’s docs create user tables with references auth.users on delete cascade, so deleting the user removes their rows. If your tables reference auth.users without it, the delete fails or leaves orphaned personal data. Also note that Storage list calls are not recursive: if users have nested folders, remove those too.

Deleting the user ends their sessions and refresh tokens. An access token already issued stays valid until it expires, so sign the user out in the app straight away.

Google Play asks for two paths

Google Play requires an in-app path to delete the account and its data, and a web link where people can request deletion, entered in Play Console. It also says temporarily deactivating or “freezing” an account “does not qualify as account deletion.” A small web page that uses the same Edge Function after the user signs in covers the web link.

How we handle it

We add the Delete account screen with a clear confirmation, move deletion into an Edge Function, check every table and bucket that holds the user’s data, revoke Sign in with Apple tokens where the app uses them, and rotate the service role key if it was ever shipped in the client.