Skip to content

DELETE athlete clears everything under the athlete; erasure stays the POST #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
DrAlexHarrison merged 1 commit into from
Sep 19, 2026
Merged

DELETE athlete clears everything under the athlete; erasure stays the POST #45

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions guides/athletes.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -189,7 +189,7 @@ Two endpoints delete, and they are not interchangeable.
DELETE /v1/athletes/{id}
```

Removes the athlete document only. Their activities, prescriptions, and feedback stay in storage.
Removes the athlete from your roster together with everything stored under them: activities, prescriptions, feedback, AI conversations, consent records, integration tokens, and gear. Connected providers are not told, and the request is not filed with the data warehouse.

```bash
POST /v1/athletes/{id}/delete
Expand All @@ -198,7 +198,7 @@ POST /v1/athletes/{id}/delete
The erasure path. It deauthorizes connected providers, purges the athlete's subcollections (activities, conversations, consent, integrations), and files the request the data warehouse honors.

<Warning>
Use `POST /v1/athletes/{id}/delete` for a GDPR erasure request. `DELETE` alone leaves the athlete's activity data behind. Neither can be undone.
Use `POST /v1/athletes/{id}/delete` for a GDPR erasure request. `DELETE` clears your copy of the athlete but does not revoke their provider connections or notify the data warehouse. Neither can be undone.
</Warning>

## Data export (GDPR)
Expand Down
2 changes: 1 addition & 1 deletion guides/data-policy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,7 +106,7 @@ Saturday provides endpoints for GDPR compliance:
| `POST /v1/athletes/{id}/delete` | Right to erasure | Cascading deletion: revokes connected providers, then deletes the profile, activities, conversations, consent records, and integration tokens |
| `POST /v1/athletes/{id}/consent`, `GET /v1/athletes/{id}/consent`, `DELETE /v1/athletes/{id}/consent/{consent_id}` | Consent records | Append-only log of consent granted or revoked, by type: `data_processing`, `marketing`, `analytics` |

Use the erasure endpoint for right-to-erasure requests. It deletes immediately, and `DELETE /v1/athletes/{id}` removes the profile record only.
Use the erasure endpoint for right-to-erasure requests. It deletes immediately. `DELETE /v1/athletes/{id}` removes the athlete and everything stored under them from your roster, but does not revoke provider connections or file the warehouse request.

Partners are responsible for responding to athlete data subject requests within the timelines required by applicable law.

Expand Down
Loading