Three ways out, all yours

A family messaging app should make it easy to step away — from a single family, from the app, or from us as a service. Shoal gives you three deliberate exits, each behind enough friction to stop accidental clicks but not so much that you’re trapped.

  • Leave a family. Removes you from that family and its conversations. Optionally also deletes the messages you sent in that family — your choice at the moment of leaving.
  • Delete a family. Admin-only. Wipes the family, its conversations, and its membership for everyone in it. Always confirmed by email.
  • Delete your account. Removes you everywhere on Shoal. Email-confirmed. If you happen to be the only admin in one or more families, we’ll tell you and ask whether to also delete those families, transfer admin to someone else first, or stop here.

How the safety rails work

Every destructive action is two-step. You confirm in the app, we email you a single-use link, you click the link to actually carry it out. The email never contains the family name — those are encrypted at rest and shouldn’t leak through a mail provider — so you’ll need to be signed in to see exactly what you’re confirming.

A family must always have at least one admin. The server enforces that across every membership change: you can’t demote yourself if you’re the last admin, you can’t be removed if you’re the last admin, you can’t delete your account without doing something about the families where you’d otherwise leave nobody in charge.

Children who were added without their own email — the admin-provisioned accounts that just live in the family’s picker — are cleaned up automatically when they have no families left to belong to. They don’t dangle as orphan rows after their last family disappears.

What “delete” actually deletes

Deleting a message removes the ciphertext from our database. Deleting a family removes the family record, its conversations, its memberships, and the per-family encrypted state. Deleting an account removes the account record and revokes all device keys.

What we can’t delete is the copy of a message that’s already arrived on someone else’s phone. Their device holds that ciphertext and the keys to read it; we can’t reach in and take it back. If that matters to you, ask the other person to delete it on their side too.

Your GDPR rights

If you’re in the UK, EU, or another jurisdiction with similar data-protection rights, the in-app delete-account flow is the simplest way to exercise your right to erasure. For other rights — access, rectification, restriction, portability — email [email protected]. We respond within 30 days. The full picture is on the privacy page.