Manage billing and your account data

What this does

Manage direct billing or a one-time Mac license, understand AES-256-GCM encryption for hosted configuration credential leaves, inspect the settings backup's partial redaction boundary, and use the signed-in self-service data page with its documented limits. A Mac purchase does not include Hosted Web.

Before you begin

• Know whether you have a direct Web subscription billed through Stripe or a one-time Mac license. Account deletion does not cancel either billing or an external service.
• Sign in with the account email before opening `/account`. Preserve any data you need and inspect external services before a deletion attempt.

Steps

1. 01

   Manage billing on the issuing rail

   For a direct Web subscription, use Manage billing to open Stripe. A one-time Mac license has no recurring ArtDrop subscription. Cancel billing separately before deleting account data.

2. 02

   Inspect, back up, and restore settings

   Hosted configuration credential leaves are encrypted at rest with AES-256-GCM, while browser views remain masked. Download my settings removes credential-pattern and known identity keys from the main config, then appends the three legacy template arrays without applying that redaction to them. Inspect the JSON before sharing it. Gelato V2 templates are omitted. Restore accepts a JSON object no larger than 1 MiB with at most 500 top-level fields and merges it into existing config.

3. 03

   Download the limited account export

   Open `/account` and choose Download my data. The signed-in self-service export returns the account email and timestamps, redacted saved configurations, and current copy-credit plan and purchased balance. It omits other records such as sessions, passkeys, magic tokens, audit history, credit-ledger entries, drop records, and license-server data. A database failure can produce an empty or partial JSON file without making the endpoint fail.

4. 04

   Treat deletion as an attempt, not a receipt

   On `/account`, type DELETE and choose Delete my account. Delete my account attempts to remove the user, configurations, passkeys, magic tokens, and sessions, then adds the email to a suppression list. The route always clears the session and returns `ok: true`, even when database access fails or the deletion summary is partial, so the response does not guarantee erasure. Reconcile account access and retained records instead of relying on the success banner.

5. 05

   Clean up every external owner separately

   Cancel billing, remove provider products and storefront listings, delete stored files, and revoke credentials in each external service. The ArtDrop account route does none of those actions.

Expected result

Billing management opens its issuing service. The settings backup redacts selected keys from main config but appends three template arrays without that redaction and omits Gelato V2. Restore is a merge and can apply partially. The account export is limited, and a deletion response does not prove erasure.

Good to know

• Hosted configuration credential leaves are encrypted at rest with AES-256-GCM. Export redaction happens after configuration is loaded and keeps the documented partial scope, so inspect exported JSON before sharing.
• The signed-in self-service export returns the account email and timestamps, redacted saved configurations, and current copy-credit plan and purchased balance. It omits other records such as sessions, passkeys, magic tokens, audit history, credit-ledger entries, drop records, and license-server data. A database failure can produce an empty or partial JSON file without making the endpoint fail.
• Delete my account attempts to remove the user, configurations, passkeys, magic tokens, and sessions, then adds the email to a suppression list. The route always clears the session and returns `ok: true`, even when database access fails or the deletion summary is partial, so the response does not guarantee erasure.
• Deletion does not remove license-server records, billing, or records in external services. The email suppression row stores the plaintext email, and the post-delete audit call writes that email into `entity_id` and into its summary details even though actor and IP fields are hashed.
• Support policy states: We respond within 30 days. The backend contains no enforceable response timer, so this service commitment needs operational confirmation.
• Settings export embeds exactly three template lists: legacy Gelato, Printful, and Printify. It omits Gelato V2 templates.
• Restore merges into existing config. It saves config before template lists, so a later exception can leave a partial change while returning failure.
• Imported legacy template arrays are appended to settings export without the main-config redaction pass. Inspect their contents before sharing the file.

Troubleshooting

• Export is unexpectedly empty? The endpoint can return a skeleton after a database failure. Do not treat an empty file as proof that ArtDrop holds no other data.
• Delete reported success? Sign-out is guaranteed by the route, erasure is not. Contact support to reconcile the deletion summary and any remaining account access.

How to undo or clean up

You can withdraw a deletion request by replying to the support thread before support confirms completion. After that it cannot be undone inside ArtDrop. The backend has no self-service undo or support-thread withdrawal workflow, so this support policy needs operational confirmation.