Munchable is a barcode scanner for people with gut conditions, and the thing it holds about you is the one thing you would not want leaked. So the delete button has to actually delete. The policy it implements is public, at munchable.app/privacy , and writing it down created a problem: the policy is one promise and the implementation is two programs that cannot share a transaction.

The server half

POST /api/delete-account runs in three stages.

Stage zero is a refusal. Erasing the identity itself needs the Supabase service-role key, and without it the route would delete the data and leave the login:

if ( ! hasServiceRole ()) { return NextResponse .…