Hate to tell you but 95% of companies do this. It's common practice. You're "deleted" account? There's a column called "DeletedDate" and it's marked to whenever you hit delete. Their query then just says "Select Account where DeletedDate is null" and yours just doesn't return until that date is cleared.

Is it asshole design? No. And it's not for privacy reasons. it's because the vast majority of people who hit delete will call the next day and yell and scream saying "But I didn't know it would delete everything". That's why Meta keeps it, and Youtube, and Google, and everyone.

Not to mention legal reasons. If someone uses your platform for illegal purposes and the feds come knocking you bet your ass you need that data or your company is liable. That is different in the EU I grant you, but that's the exception, not the common practice. Over there they can point to GDPR and say "That's why we don't have it". Anywhere else you're pretty screwed.

So. Not asshole design. The session staying open is bad security though. Everything else is just knowing your userbase and knowing that people will be pissed and need something. If you want privacy stop giving your data to companies in the first place.

I think this is probably the way on practically every site that allows you to delete your account.

I usually fill my account details with garbage data before deleting my account. That way, even if they don't actually delete it, it's useless to them, and keeps me out of it.

I do the same for accounts that cannot be deleted or closed (so, sooo many sites).

Open source LLMs are a great alternative to cai anyway. The community's been finetuning them before Llama v1 was even a thing, and before ChatGPT blew up, and they’re darn smart now.