Your users' data

NoMac never stores your users' secrets: a token travels with the call that uses it. Below is what a phone keeps for a user, and the one call that deletes it.

A private repository

const { root } = await phone.fetchGit({ url: "https://github.com/acme/app", token: githubToken });

The token goes with that one fetch, to the git host only. It is kept nowhere: not in NoMac's database, logs, replay or workspace, and not for the phone's next fetch. Your user's token stays with you, and a short-lived one, such as GitHub's one-hour tokens, works.

Only to github.com, gitlab.com and bitbucket.org. For another host, upload the project instead.
It reaches git as an HTTP header, never the repository's config, and is removed from git's error text.
A phone's own token may send one, so your user's agent can fetch their repository itself.

Values the app needs, such as a staging API key, go with the run as env on app_run. The phone keeps them for relaunches until it stops, and they are erased with it.

For your own repositories, the account can keep a token as a secret and name it with secret instead. A phone's token never reads the account's secrets.

What NoMac keeps for a user

Workspace: Their projects and build cache, on an encrypted volume, until 90 days unused.
Saved states: Until you delete them, or 90 days after the account's last phone, each under its own key.
Replays and files: Replays for 7 days. Uploads, and copies of files the phone's answers named, for a few hours.
Phone records: Times and cost, under the label, for billing.
Never: Their tokens, or the values their apps were given.

Delete a user

await nomac.labels.delete("user-42");
// { label: "user-42", deleted: { states: 2, workspaces: 1, replays: 3, files: 0 } }

When your user deletes their account, one call with the account's key deletes their saved states, their phones' replays and file copies, and their workspace. The workspace's key is destroyed at once, so its encrypted volume can never be opened again; the host deletes the volume itself within 90 days. Repeating the call finds nothing left.

Stop the user's phones first: a running one answers label_in_use (409) with their ids.
For 15 minutes after the last one ends, its replay is still being saved: label_busy (409) with retry_after_seconds.
Phone records stay under the label, so use your own user id as the label, not an email.