Export your data and delete your account
You can download the personal data CodeStax holds about you, and you can schedule permanent deletion of your account. Both actions apply to your own account, not to the whole organization. Organization-wide actions, such as closing the organization, are under Settings → Organization → General.
Open Settings and select Delete account in the Account group. You can also go directly to /dashboard/settings?tab=delete-account.
Download your data
- Open Settings → Delete account.
- Under Download my data, click Export data.
- The browser downloads
codestax-data-export-<date>.json, and CodeStax emails you that the export is ready.
The export is a single JSON file generated on request. It contains:
| Section | Contents |
|---|---|
user_profile | Name, email, avatar, verification state, creation and last-login times, connected sign-in providers |
organizations | Each organization you belong to, your role and when you joined |
invitations_sent | Invitations you sent and whether they were accepted |
notification_preferences | Your email notification settings |
connected_integrations | Connected source-control and other integrations, with username, scope and connection time (no tokens) |
in_app_notifications | Your in-app notifications |
activity_log | Audit-log entries for actions you performed |
assigned_issues | Findings assigned to you |
comments | Comments you wrote on findings |
scan_activity_summary | A summary count of your scan activity |
review_chat_requests | PR review chat requests and their retention status |
ai_execution_events | Records of AI processing performed for your reviews |
Every export is recorded in the organization audit log.
Delete your account
- Open Settings → Delete account.
- Under Delete my account, click Delete account.
- In the Delete account dialog:
- If you sign in with a password, enter it in Confirm password. Accounts that sign in only through GitHub, GitLab, Bitbucket or SSO are not asked for one.
- Optionally pick a Reason: Not useful for my needs, Too expensive, Switching to another tool, Privacy concerns or Other.
- Type
DELETEin capitals to confirm.
- Click Schedule deletion.
The account is scheduled for permanent deletion 30 days later. CodeStax emails you a confirmation with the deletion date, and the settings page shows Account deletion scheduled with the days remaining. Your account keeps working normally during the grace period.
If deletion is already scheduled, requesting it again does not restart the clock; the original date is kept.
Cancel a scheduled deletion
- Open Settings → Delete account.
- In the Account deletion scheduled banner, click Cancel deletion.
You can cancel at any time before the scheduled date. After the date passes, deletion runs automatically within minutes and can no longer be cancelled.
What deletion removes
When the grace period ends, CodeStax permanently deletes or anonymizes your data and sends a final confirmation email.
| Data | What happens |
|---|---|
| Your user record and sign-in details | Deleted |
| Connected integrations and their OAuth tokens | Deleted |
| In-app notifications, notification settings, usage logs, AI feedback | Deleted |
| Invitations you sent or received | Deleted |
| Your organization memberships | Removed |
| Audit-log entries you appear in | Kept for the organization, with your identity, IP address, user agent and details removed and the actor shown as [deleted user] |
| Comments you wrote on findings | Kept, attributed to [deleted user] |
| Findings, triage decisions and scheduled scans assigned to or created by you | Kept, with the assignment or owner cleared |
| Organizations where you are the only owner | Deleted with their subscription, repositories, scans and findings |
If you are the only owner of an organization, deleting your account deletes that organization and all of its repositories and scan history. To keep the organization, another member must hold the owner role before the grace period ends. The dashboard does not offer an ownership-transfer action; contact support@codestax.co, then cancel and reschedule your deletion if you need more time.
Use the API
These endpoints act on the signed-in user. They require a signed-in session.
| Method | Path | Purpose |
|---|---|---|
POST | /api/gdpr/export | Generate the JSON export; the file contents are in the response’s data field |
POST | /api/gdpr/delete | Schedule deletion; body {"password": "<password>", "reason": "<reason>"} (password required for password accounts) |
POST | /api/gdpr/cancel-deletion | Cancel a pending deletion |
GET | /api/gdpr/deletion-status | Return none, or scheduled with deletion_date and days_remaining |
POST /api/gdpr/delete returns 400 when a password account omits the password and 403 when the password is wrong. POST /api/gdpr/cancel-deletion returns 400 when no deletion is pending.