Three years of journal entries. Every goal you set and whether you hit it. A record of what you were worried about in the spring of a hard year.
That's a genuinely valuable archive, and it's also the thing that quietly makes leaving unthinkable. Not because anyone locked the door — because at some point the cost of walking away stopped being the subscription and started being the history.
Products know this. It's the oldest retention mechanic there is, and it doesn't require anybody to be a villain. You just have to build the accumulation and not build the exit, and inertia does the rest.
So here's the argument: the ability to leave with your data is not a nice-to-have. It's the thing that makes the accumulation safe to do in the first place — and it's checkable in about ten minutes, before you've handed over three years.
Two rights, and they're not the same
People collapse these, and the difference matters.
Portability is the right to take a copy with you: your data, in a form another system could actually read.
Deletion is the right to have it removed from theirs.
You want both, and neither substitutes for the other. Export without deletion means you have a copy and so do they, forever. Deletion without export means you can leave but only by abandoning your history, which is precisely the choice that keeps people in products they'd rather leave.
Notice which one products tend to build first, and why the asymmetry is structural rather than cynical. Deletion is a single destructive operation, relatively easy to implement, and regulators ask about it. Export has to be extended every time the product grows a new feature, and nobody is auditing whether it was. So the shape this tends to produce is a company that can genuinely delete you and cannot genuinely hand you your history — which is the worse of the two gaps to have, since it means the only way out is to lose the thing that made staying valuable.
Portability also has a legal shape worth knowing, because it sets a floor you can hold companies to. GDPR Article 20 gives people in scope the right to receive their personal data in a structured, commonly used, machine-readable format — and, where technically feasible, to have it sent directly to another provider. That phrase is doing specific work: a PDF of screenshots is not machine-readable in any useful sense, and an export that technically exists but can't be ingested by anything is compliance theatre.
The four questions
Ask these before the archive gets big enough to trap you.
1. Can I export, and in what format? JSON or CSV means a machine can read it. A PDF means you have a souvenir. Ask whether the export includes your actual content — the entries, the notes — or only metadata like dates and titles.
2. Does the export include everything, or only some of it? This is the question the mechanics make easy to skip, and it's where an export can quietly fall short. Products grow feature by feature, and export code tends to be written once and then not extended as new data types arrive. The result is an export that was complete in year one and is missing three feature areas by year three, without anyone deciding that.
3. What does deletion actually remove? "Delete my account" can mean anything from "your rows are gone" to "we've flipped a flag and your data is exactly where it was." Ask specifically what is removed, what is kept, and why.
4. Is there a timeline, and is it real? Backups exist; a few days to propagate is normal. What you're checking is whether the company can state the timeline at all — and whether it's a policy someone implemented or a sentence someone wrote.
Our own answers, including the parts that don't flatter us
Time to take our own test, and this is the section where these posts usually go soft. We'll try not to.
Export: yes, JSON, self-serve. One click, no support ticket, and no subscription gate — which matters, because a paywalled export is an export that disappears exactly when you need it. If your plan lapses, you can still pull your archive. It includes your account details, profile, goals with their milestones and occurrences, journal entries with the content decrypted, coaching sessions with full message transcripts, and feedback you've submitted. There's also a separate journal-only export that offers CSV as well as JSON.
And it does not currently include everything. Tasks, habits, assessment results and responses, five-year plans, saved advice and suggestions, forum posts, notifications, badges, billing history, and audit logs are not in that file today. If you exported tomorrow, you'd get the heart of it — goals, journal, coaching — and you would not get your assessment history.
That's a real gap and we'd rather you hear it here than discover it on your way out. It's exactly the failure mode described in question two: an export written when the product was smaller, not extended in lockstep as features arrived.
Deletion: immediate, and it removes the account itself. Deleting your account requires your password and typing DELETE in capitals, which is deliberate friction on an irreversible action. It then deletes your account row and everything attached to it — profile, goals, milestones, journal entries, coaching sessions and messages, tasks, habits, assessment results and responses, five-year plans, saved advice and suggestions, notifications, billing records, MFA configuration, policy acceptances. Not deactivated. Not renamed. Removed.
Worth saying how that changed. Until recently, deletion destroyed your content and then kept your user row, rewritten to a placeholder email — and because most tables pointed at that retained row, a lot of your data stayed with it. Writing that down honestly is what got it fixed. It is now a hard delete, and the checks that prove it run on every build.
One thing survives, and we'd rather name it than let you discover it. The access log — the record of which resources were read and written, and when — is kept, with the identity stripped out of it. Your user id, your IP address and the descriptive text are removed; what remains is a timestamped record that operations occurred, no longer linked to you and not traceable back. That log is how we can demonstrate that access to private data was appropriate, which is the one accountability question that outlives the account.
Two footnotes. The log is hash-chained so tampering is detectable, and stripping fields out necessarily breaks that chain for those entries — our own integrity checker flags them, and we treat that as a documented consequence of honouring an erasure rather than something to hide. And GDPR Article 17(3) is the provision carving out narrow exceptions to erasure; we're not claiming it blesses everything, only that a de-identified operational log is the kind of record it contemplates.
The honest sentence now: "delete" in our product means your account and your data are gone, and what remains cannot be tied back to you.
Timeline: immediate in the database, with one honest window. There's no delay built into deletion, no grace period, and no scheduled purge job — your rows are removed when you confirm. The window is our own answer to question 4: deleted data can persist in our encrypted database backups until those backups age out, and backups are pruned after 30 days. We'd rather state that ceiling than let "immediate" do more work than it should. (An earlier version of our documentation described a retention-then-purge policy that was never implemented; that line has been corrected to match what the code actually does.)
Why we're publishing the gaps
Two reasons, and the second is the real one.
The first is that the seven questions argued that evasive answers are themselves an answer. It would be strange to publish that and then answer our own questions evasively.
The second is that this category has earned suspicion the hard way. The FTC's 2023 action against BetterHelp turned on a therapy platform sharing users' health information — including their answers to intake questions — with advertising platforms after promising it wouldn't. When that's the backdrop, a company saying "we take your privacy seriously" conveys approximately nothing. What conveys something is specificity, including specificity about what isn't finished.
We'd rather be the product that told you its export was missing assessments than the one you found out about later. And writing it down publicly is the most reliable mechanism we know for making sure it gets fixed.
What portability looks like in a product that means it
Beyond the mechanics, a few signals worth reading.
The export is self-serve. If you have to email support, the friction is doing retention work whether or not anyone intended it.
The format is documented. A JSON file with a described shape is portable. An undocumented dump is technically an export and practically a puzzle.
Deletion doesn't route you through a save-offer. The cancellation flow that offers three discounts before the button is a dark pattern with a name — confirmshaming's cousin — and a company willing to do it there will do it elsewhere.
They'll tell you what survives deletion, and why. Every real system retains something — audit logs, billing records, backups on a rotation. The tell isn't whether anything is retained. It's whether they'll say what, and give a reason that isn't "for our records."
And the pricing doesn't punish leaving. Data held hostage behind an active subscription is the least subtle version of this: if the export button stops working the day you cancel, the export was never really yours. Check whether you can pull your archive after the account lapses, because that's the moment you'll most want it and the moment the product has least incentive to help.
An export nobody can import is a technicality
This is the gap between a right that exists and a right that works.
A file you can download is only portability if something can read it. A proprietary format, an undocumented schema, or a dump with no field names satisfies the letter of a portability obligation while leaving you holding an archive rather than an asset. The test isn't "can I get my data out." It's "can I get it into something else, and would anything of value survive the trip?"
Some of what makes a product useful genuinely doesn't travel, and honesty requires saying which parts. Your own writing travels — it's text, and text moves. Structured records travel, if they're labeled. What doesn't travel is anything the product derived: patterns, readings, summaries, whatever a system built up about you over months. Another product can't ingest that meaningfully even if it's in the file, because it doesn't share the model that produced it.
So the realistic promise isn't "leave with everything intact." It's "leave with the things you put in, in a form something else can read, and lose the interpretations." That's a smaller claim than most portability pages make, and it's the one we'd rather be held to.
What to actually do
Concretely, before your archive gets large:
Export once, early. In the first month, not the third year. You learn immediately whether the export is real, what it contains, and whether the format is usable — while the cost of walking away is still low. Open the file, too. An export you never looked at is a belief, not a backup, and the difference tends to surface at the worst possible moment.
Then export on a schedule. Once or twice a year is plenty. It's the same instinct as keeping a backup, and it converts your history from something a company holds into something you hold a copy of.
And keep the truly irreplaceable somewhere you control. As we've argued about journals, the practice is the point and the storage is infrastructure. If losing something would genuinely hurt, a copy in a plain file on your own machine costs nothing.
None of this is about expecting the worst of a product. It's the same reason you'd keep a copy of your own photos. The company might be excellent and still get acquired, pivot, or shut down — and the exit you never tested is the one that fails when you need it.
Where NexTier fits, briefly
Our answers live on the trust page, and this post is the fuller version. Self-serve JSON export covering goals, journal and coaching — but not yet assessments and several other types. Deletion that removes your account and everything attached to it, leaving only a de-identified access log. No implemented purge timeline, because with a hard delete there is nothing queued to purge.
The export gap is still a gap rather than a position, and naming it publicly is the first step to closing it — which is exactly what happened to the deletion gap this post used to describe. In the meantime, the advice we'd give about us is the advice we'd give about anyone: export early, so you find out what leaving costs while it's still cheap.
—
This post is part of a series on personal development organized around what we call Maslow's extended hierarchy — our synthesis of his later work. Sources: Regulation (EU) 2016/679 (GDPR), Article 20 — right to data portability, requiring a structured, commonly used and machine-readable format — and Article 17(3), the erasure right's enumerated exceptions; U.S. Federal Trade Commission, In the Matter of BetterHelp, Inc. (2023) — ftc.gov. Disclosure: NexTier is the product described in the "our own answers" section; those descriptions were verified against the live codebase at the time of writing and the gaps named are current as of then. This post is educational content, not legal advice.