From 8283e97e91f54cadffcaaf8d767f98eafe462702 Mon Sep 17 00:00:00 2001 From: Alex Harrison Date: Sat, 19 Sep 2026 12:33:32 -0600 Subject: [PATCH] DELETE athlete clears everything under the athlete; erasure stays the POST fuel-backend now deletes an athlete's activities, conversations, consent records, integration tokens and gear together with the profile on DELETE /v1/athletes/{id}. The guide and the data-policy table say so, and keep the erasure request as the path that also revokes providers and files the warehouse request. Co-Authored-By: Claude Fable 5.1 Claude-Session: https://claude.ai/code/session_01K9f7KoPEPs8FXwBT8vAduy Ci-From: linux Ci-Session: f2e28bc2-ac58-48e1-a2b8-39bf8e777e80 --- guides/athletes.mdx | 4 ++-- guides/data-policy.mdx | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/guides/athletes.mdx b/guides/athletes.mdx index 9a5dc81..c2467ab 100644 --- a/guides/athletes.mdx +++ b/guides/athletes.mdx @@ -189,7 +189,7 @@ Two endpoints delete, and they are not interchangeable. DELETE /v1/athletes/{id} ``` -Removes the athlete document only. Their activities, prescriptions, and feedback stay in storage. +Removes the athlete from your roster together with everything stored under them: activities, prescriptions, feedback, AI conversations, consent records, integration tokens, and gear. Connected providers are not told, and the request is not filed with the data warehouse. ```bash POST /v1/athletes/{id}/delete @@ -198,7 +198,7 @@ POST /v1/athletes/{id}/delete The erasure path. It deauthorizes connected providers, purges the athlete's subcollections (activities, conversations, consent, integrations), and files the request the data warehouse honors. - Use `POST /v1/athletes/{id}/delete` for a GDPR erasure request. `DELETE` alone leaves the athlete's activity data behind. Neither can be undone. + Use `POST /v1/athletes/{id}/delete` for a GDPR erasure request. `DELETE` clears your copy of the athlete but does not revoke their provider connections or notify the data warehouse. Neither can be undone. ## Data export (GDPR) diff --git a/guides/data-policy.mdx b/guides/data-policy.mdx index 346dff9..35d5c5b 100644 --- a/guides/data-policy.mdx +++ b/guides/data-policy.mdx @@ -106,7 +106,7 @@ Saturday provides endpoints for GDPR compliance: | `POST /v1/athletes/{id}/delete` | Right to erasure | Cascading deletion: revokes connected providers, then deletes the profile, activities, conversations, consent records, and integration tokens | | `POST /v1/athletes/{id}/consent`, `GET /v1/athletes/{id}/consent`, `DELETE /v1/athletes/{id}/consent/{consent_id}` | Consent records | Append-only log of consent granted or revoked, by type: `data_processing`, `marketing`, `analytics` | -Use the erasure endpoint for right-to-erasure requests. It deletes immediately, and `DELETE /v1/athletes/{id}` removes the profile record only. +Use the erasure endpoint for right-to-erasure requests. It deletes immediately. `DELETE /v1/athletes/{id}` removes the athlete and everything stored under them from your roster, but does not revoke provider connections or file the warehouse request. Partners are responsible for responding to athlete data subject requests within the timelines required by applicable law.