Leaving, and what it does and does not cost you.

• Cancel from the account page in the app. It is one action by the person who owns the subscription — on a shared plan, a member cannot cancel the bill they are not paying.
• On a card subscription that action reaches Stripe before it is recorded here. The app asks the payment provider to stop the renewal and writes the cancellation on your account only once the provider has confirmed it, so what the account page says and what your card does cannot come apart.
• If the payment provider cannot be reached, nothing is changed at all — and you are told so. You do not get a screen saying the plan is ending while the card keeps being charged: the plan, the bill and the renewal date all stay exactly as they were, the app says the provider did not answer, and you can try again. Stripe's own billing portal is the other route, with a caveat this page will not skip: the link into that portal is created by our server, over the same connection that has just failed, so an outage which reaches us can take that link with it. What happens inside the portal is Stripe's, and nothing on our side touches it.
• It takes effect at the end of the period you have already paid for, not immediately. You keep the plan and its limits until then.
• You can undo it at any point before the period actually ends, and the subscription simply carries on — and that undo goes to Stripe first as well, on the same terms.
• Moving a card subscription onto the free plan is the same act as cancelling, and the app says so rather than quietly doing something else. There is no free price to switch a card subscription onto, so choosing Free is refused there with a sentence pointing at “End this plan” — which stops the card at the end of the period you have paid for.
• If you paid by card, Stripe's own billing portal is reachable from the same page and is where you change a card or end a subscription on Stripe's side.
• Nothing is sent to confirm it — not a cancellation notice, not a receipt, not anything, because we hold no address for you. The account page is where the state is; it will say the plan is set to end and on what date.

• Cancelling deletes nothing. After the period ends, free limits apply to new activity — an upload over the free quota is refused — and every message, attachment and conversation stays exactly where it is.
• A failed payment deletes nothing either. The subscription goes past due, free limits apply until it is settled, and that is the whole of what "degraded" does.
• The history sweep deliberately skips past-due and cancelled subscriptions. This is not an accident of ordering: the sweep used to resolve its deletion window from the degraded plan, so a Business account with five years of history acquired a 90-day deletion window the instant a card bounced. That mapping was deleted from the code rather than special-cased around, and the test suite proves it in both directions.
• Choosing the free plan yourself is a different act, and it does have a consequence: Free carries a 90-day window, so from that point the server begins deleting its copy of messages older than ninety days. It cannot reach a device that already synced the plaintext.
• Being moved onto Free by somebody else — removed from a shared plan, or re-homed because its owner deleted their account — stamps a floor that permanently exempts everything written before that moment from any plan-level window.
• Deleting your account is a different act from cancelling, is done in the app with your password, and is the thing that actually removes data. What survives it is named on the privacy policy.
• Deleting your account also stops the card, and stops it today rather than at the end of the period you have paid for. The subscription is cancelled at the payment provider first and the account is deleted only once the provider has confirmed it — deleting the account destroys the only handles we hold for that subscription, so a card that was not stopped first is a card nobody here could ever stop again. Two consequences worth knowing before you press it: the unused remainder of a paid period is not returned automatically — that is a refund question, and section 3 says how one is made, which works after deletion too because the invoice outlives the account — and if the payment provider cannot be reached, the deletion is refused and nothing is changed at all. Your account, your plan and your card stay exactly as they were and you are asked to try again. Refusing for a minute is recoverable; deleting an account whose card we can no longer stop is not.
• And the case in between, which a page like this usually leaves out. Cancelling at the payment provider is immediate and cannot be undone, and the deletion that follows it runs against a database that can, rarely, refuse — a lock held by another process, a full disk. Every reason we could refuse your deletion for is settled before we cancel anything, so an ordinary refusal costs you a message and nothing else. But if the cancellation succeeds and the deletion then fails, your subscription is cancelled and your account is still here, and we will not leave that quiet: the subscription is marked cancelled so nothing in the product goes on advertising a plan you no longer have, your security log gets an entry saying exactly this happened, and our billing ledger gets one too — that ledger entry carries no link to your account and so outlives it, which is what keeps a refund workable afterwards. The cancellation is not undone, and the part of the period you had already paid for is not returned. Deleting again is safe and cancels nothing twice.

• An unredeemed code can be revoked by an operator and the purchase refunded through whatever channel it was bought on. Quote the first four characters — they are stored in the clear so a code can be found — and nothing more. Never send anybody the whole code, including us.
• A redeemed code has already bought months on an account. We can credit that account or extend it. We cannot send money back to a person we cannot identify, and we are not going to invent an identity check to do it — that would undo the property the voucher exists to provide.
• Nobody can recover the code itself after minting, including us: only a one-way hash is stored, and the plaintext was shown exactly once to whoever minted it. A lost code is revoked and replaced, not looked up.
• A voucher plan does not renew and cannot fail to pay. It runs for the months it bought and then the account returns to Free. Nothing warns you first — we have no way to — so note the end date when you redeem it.
• Card and voucher do not stack. An account already on unexpired voucher months is refused a card checkout, deliberately, rather than being charged for months it has already been given.

A chargeback is between you, your bank and Stripe; we are told about it and we can respond to it. What we can show is the invoice, the plan and the dates. What we cannot show is anything about your messages, because we cannot read them — which occasionally makes a dispute harder to resolve in our favour, and is a cost of the design we accept.

It is also why invoices and ledger entries deliberately carry no foreign key to your account and survive its deletion. A financial record that vanishes the moment somebody presses "delete my account" cannot answer a chargeback or a tax question six months later. That trade is disclosed on the privacy policy and on the account's own panel rather than left for somebody to find out during a dispute.