Your users have profiles on your web application. And normally you should give them a way to delete their profiles (at least that’s what the European Court has decided). That “simply” means you need to have a /forget-me endpoint which deletes every piece of data for the current user. From the database, from the file ...