Account and privacy
How Go Bananas handles your account: downloading your data, deleting your account, confirming your email, how API keys are stored, and how long operational data is kept. The full policy is the Privacy Policy.
Open Your account from the account menu (your name or avatar in the sidebar) to download your data or delete your account.
Download your data
Your account → Download your data gives you one JSON file with:
- your account details (email, name, role, when you joined)
- the workspaces you belong to and your role in each
For workspaces you own or manage, it also includes their content:
| Included | Notes |
|---|---|
| Images | As links, with prompt, model, size and date |
| Characters, product references, style presets, scenes, reference groups | Full definitions |
| Sessions | IDs, image counts and activity dates |
| Webhooks | URLs and notification settings |
| API keys | Names and masked previews only |
The file never contains passwords, sign-in or OAuth tokens, provider API keys, Go Bananas API key values, or webhook signing secrets.
Delete your account
Your account → Delete account asks you to type your email to confirm. Then:
- You're signed out everywhere straight away: browser sessions and every AI client connected through sign-in (OAuth). Clients using a workspace API key keep working until the workspace is deleted. We email you the date deletion will happen.
- You have 7 days to change your mind. Signing in again within those 7 days cancels the deletion.
- After 7 days it happens for good. Your account is deleted, and so is every workspace you own that has no other members, including its images and other stored files. Workspaces run by other people aren't deleted; you simply stop being a member.
When you can't delete yet
If you own a workspace that other people also belong to, deletion is blocked, because that workspace would be left without an owner. Remove the other members or hand over ownership first; the page lists the workspaces in the way. If someone joins one of your workspaces during the 7 days, the deletion is cancelled and you're emailed instead.
Super admin accounts can't be deleted from this page.
Confirm your email
If you sign up with an email and password, we send a confirmation link (valid for 24 hours). You can sign in straight away, but your workspace is only created once you've confirmed. A banner shows where the link was sent and has a Resend link button.
You don't need to confirm if you joined through an invitation (the invite link already proved your address) or signed in with Google or GitHub.
How API keys are stored
Go Bananas API keys (sk_live_…) are shown once, when you create them. We keep only a SHA-256 hash of the key plus a masked preview (the first 10 and last 4 characters) so you can tell your keys apart in the console. We can't show a key again: if you lose one, create a new key and revoke the old one.
Keys created before hashing was introduced keep working and are converted to the hashed form automatically.
How long we keep data
Your account, workspaces, images and other content stay until you delete them. Usage records are kept too, because they drive quotas and the usage dashboard. Operational data is deleted on a schedule, checked every hour:
| Data | Deleted |
|---|---|
| Sign-in sessions | 30 days after they end |
| Connected-app (OAuth) access and refresh tokens | 7 days after they expire |
| OAuth authorisation codes | 1 day after they expire |
| One-time links (password reset, email confirmation) | Once expired |
| Sign-in rate-limit records | Once expired |
| Job logs | 90 days after the job started |
| Security audit log | After 1 year |
| Invitation email delivery records | After 180 days |
Related
- Privacy Policy
- Authentication: API keys and OAuth
- Security architecture: how this is implemented