> ## Documentation Index
> Fetch the complete documentation index at: https://docs.anonalabs.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Delete a user's memories, provably
> A data-subject request answered end to end: find everything about one person, export it, remove it, show your work.
[← All use cases](/use-cases/overview)
## The scenario
Someone emails asking what you hold about them, and then asks you to delete it.
You have a deadline measured in days, and "it is spread across a memory system"
is not an answer you can send.
The whole thing turns on one earlier decision: whether writes were scoped. If
every memory about a person carries their scope, this is a runbook. If not, it
is a manual search you cannot certify.
## Step 1 — Find everything about them
```python theme={null}
hits = client.retrieve(
space_id="support",
query="*",
user_id="user-4417",
limit=100,
)
```
A scoped read is strict — it matches only memories carrying that scope, and
never untagged ones. That strictness is exactly what you want here: the result
is defensible rather than best-effort.
## Step 2 — Give them a copy first
The subject is usually entitled to the data before it goes. Take the export
*before* deleting — see [Export Your Memory](/guides/export) for the full-space
bundle, and keep the scoped results above alongside it as the per-person record.
## Step 3 — Delete, one by one, and keep the ids
```python theme={null}
removed = []
for row in hits:
client.delete_memory(space_id="support", memory_id=row["memory_id"])
removed.append(row["memory_id"])
print(len(removed), "memories removed")
```
Keep `removed`. The list of ids, with a timestamp, is what you attach to your
response to the request.
## Step 4 — Prove it
```python theme={null}
assert client.retrieve(space_id="support", query="*", user_id="user-4417", limit=100) == []
```
Re-running the same scoped query and getting nothing is the evidence. Run it as
a test, not by eye.
## Evals
1. Write ten memories for one user and five for another.
2. Run the runbook for the first. Confirm exactly ten ids come back.
3. Confirm the second user's five are untouched — the most important assertion
here, and the one a manual process gets wrong.
4. Re-run the scoped query and assert empty.
## Guardrails
**Deletion is permanent and there is no undo.** Export first, every time, and
have the exported bundle in hand before the first `delete_memory` call.
* **Unscoped memories are invisible to this process.** If you adopted scoping
late, memories written before it carry no `user_id` and a scoped query will
never find them — meaning your deletion is incomplete and you will not be
told. Scope from day one, or backfill before you promise anything.
* **A shared space needs the same runbook run by its owner.** Deleting is
owner-only; a visitor cannot erase data from a space they were invited to.
* **Consolidated observations are derived from raw facts.** Removing the facts
is the operation that matters; re-check with a scoped read afterwards rather
than assuming a synthesis disappeared with its sources.
* **This page is a runbook, not legal advice.** What your obligations are, and
within what deadline, depends on your jurisdiction and your role as controller
or processor.
## Built from
Both are complete, runnable scripts:
[`support_bot_scoping.py`](https://github.com/anonalabs/Anona-Memory-SDK/blob/main/examples/support_bot_scoping.py),
[`user_profiles.py`](https://github.com/anonalabs/Anona-Memory-SDK/blob/main/examples/user_profiles.py).