website/ACCOUNT_DELETION.md

@@ -369,6 +369,14 @@ Asked while building core (§6 step 2), the same day:
    Home. The demo refusal and the no-password and last-admin refusals are covered by tests
    only; step 6 walks them.
 5. **runicgateway.com**: §4.5, plus `PLAY_DATA_SAFETY.md` regenerated. One PR.
+   **Built 2026-10-30.** The facts are the `deploy-account-deletion` row in `collection.mjs`, in the
+   website's words, with how long each kept thing is kept, which Play asks and the screens don't
+   say. The row also lists the delivery log's hashes and the suppression list, which §4.1's list
+   has and the screens leave out. The app rows that a deletion touches say so, and the Data Safety
+   notes answer "yes" and name the URL. Two answers from the org lead (runicgateway.com `PLAN.md`):
+   - **D85:** the page is linked from the footer's legal bar, `/privacy` and `/app/`.
+   - **D86:** someone who cannot sign in is told to try "Forgot your password?" first, then their
+     community's operator. They are never pointed at us, and the page says we cannot do it.
 6. **A walk**, using a throwaway account on each surface:
    - delete on the website, and in the app on the emulator
    - the other device's session dies on its next request