Delete with your Recovery Kit
This flow is for an account whose offline Recovery Kit begins with WT-RK1. The kit is checked in this browser. The page sends a method identifier and a one-time cryptographic proof to WatchtowerHome; it does not send the Recovery Kit or its private key.
Permanent action
Confirm the deletion request
Stay on this page until it confirms a durable deletion receipt. If the result is uncertain, resume the same request from this browser instead of starting another one.
Paste the complete WT-RK1 code. It is cleared from the field as soon as you press the deletion button and is never saved by this page.
Pressing Enter or pasting does not submit. Only the explicit button below sends the request.
Checking this browser’s protected-request support…
Use only https://watchtowerhome.com/account-deletion/. Check the complete address in the browser before entering a Recovery Kit. Do not put a kit in a URL, email, chat, support ticket, QR reader, analytics form, or any other website. WatchtowerHome staff do not need the code to process a deletion.
Delete in the app
- Open Account, scroll to Danger zone, and choose Delete account permanently.
- Review the consequences, select the acknowledgement, type DELETE exactly, and complete fresh operating-system confirmation when the device provides it.
- Keep the app open until the server returns its durable receipt and this installation finishes deleting app-owned keys, recordings, settings, and temporary capture residue.
The Recovery Kit stays local
The browser verifies the kit checksum and imports its P-256 key through WebCrypto. It checks the server’s registered public key, account-and-Space binding, action, origin, audience, nonce, and expiry before signing a fixed deletion transcript. It accepts a deletion as complete only after the server returns a durable receipt.
To recover safely from a closed tab or lost response, this origin stores one random 32-byte request capability, whether a completion may have been sent, and the nonsecret challenge expiry. It never stores the Recovery Kit, private scalar, account or Space IDs, public key, nonce, or signature. After a receipt is confirmed, use this page’s separate matching removal button rather than clearing another pending attempt.
What a request covers
A confirmed request atomically disables and anonymizes the account and owned Spaces; revokes devices, cameras, memberships, grants, invitations, live and playback authority; removes recovery and transfer authority; retires media keys; purges camera status and motion-alert rows; and queues owned encrypted event objects for deletion. Active durable camera and viewer connections are closed before success is returned.
Local device data
Server account deletion cannot reach snapshots, recordings, downloaded event media, archives, settings, or device backups outside the service. Use the app’s local deletion and retention controls, then use the operating system’s app-data removal or uninstall flow on every device you control.
An operating system, device backup, copied archive, or storage medium may retain a copy after ordinary app deletion. The current preview does not claim physical secure erasure.
What may remain after logical removal
Residual records can remain in database write-ahead logs, security or audit records, encrypted backups, device backups, or copies held on another participant’s authorized device. The current preview publishes no physical-erasure or backup-purge service level. A minimal digest-only deletion receipt and immutable security audit record remain so the server can prove and safely replay the deletion outcome.