In short: an open source directory called JustDeleteMe rates how hard it is to close your account at 2,596 services. Half of them close with a button. One in three requires writing to customer service. And 159 services are rated impossible. The interesting part for an SMB isn't the list: it's that how easily you can leave is a product feature, known in advance, and therefore a purchasing criterion. With a twist: under Law 25, your own business gets rated too.
You cannot delete your Blogger account without deleting your entire Google account. That isn't a forum rumour: it's the official note the JustDeleteMe directory attaches to the service, and it's the very definition of its worst rating, impossible.
Now take a case that looks more like your week. A project wraps up, the Slack workspace that carried it is no longer useful, and you want to close it. The directory entry warns you: if you are the team's primary owner, you must either delete the whole team or transfer its ownership before leaving. The person who opened the account back then left the organization two years ago. You are now stuck with a workspace nobody can close, holding client conversations, that just keeps existing.
Both examples come from the same place: a directory kept up to date for thirteen years, documenting how to close your account at nearly every web service on the market. It looks like a consumer tool. It is in fact one of the few public inventories of a vendor's exit cost, and that reads like a business document.
The concept, the short version
JustDeleteMe is a list. For each web service, it gives the direct link to the account closure page, an explanatory note when the process is convoluted, and above all a difficulty rating. The starting idea is simple: companies deliberately file this information where nobody looks for it, so someone gathered it once and for all.
The project has a story worth telling, because it says something about how open source tools survive. Robb Lewis launched it in 2013 under the MIT licence. Its original repository received its last commit on 18 July 2017, then nothing: nine years of silence, with dozens of pending contributions nobody was processing any more. The community did what the licence allows. A group of contributors picked up the code under the name jdm-contrib, stating plainly that they wanted to keep the project alive, the original one having been abandoned. That is the version feeding the site today, with more than 4,100 commits on the clock and daily activity: the day these lines were verified, the latest change dated from that same morning.
This is exactly the scenario we point to when we talk about digital refugees and dependence on the web giants: an abandoned proprietary tool dies with its vendor, an abandoned open source tool changes hands.
The five ratings, and what they actually measure
The project's contributing guide defines each rating in black and white. This isn't a subjective impression, it's a grid applied by hundreds of contributors.
| Rating | The project's definition | Services | Share |
|---|---|---|---|
| Easy | A "delete my account" button, and you are done | 1,317 | 50.7% |
| Medium | Deletion exists, but it takes extra steps | 265 | 10.2% |
| Hard | You have to write to customer service, or nothing is automated | 841 | 32.4% |
| Limited | Deletion is offered only to residents of a territory with privacy legislation, with proof required | 14 | 0.5% |
| Impossible | No way to actually delete the account, even by writing in | 159 | 6.1% |
Half the web behaves properly. The other half doesn't. And the number that matters to an organization isn't the 6.1% rated impossible: it's the 32.4% rated hard, because that's where the real cost hides. Writing to customer service means opening a ticket, proving your identity, waiting, following up, and tying up someone on your side while it drags on. Multiply that by the number of subscriptions your organization has piled up over ten years.
How the tools you already use are rated
The big office names do well. Zoom, Dropbox, Mailchimp, Canva, Notion, Asana, Trello, Miro, Figma, Zendesk, GitHub, GitLab and Zoho are all rated easy. That is something you can check for yourself in thirty seconds.
What's instructive lies elsewhere, and comes down to one shared trait: the friction isn't technical, it's organizational.
| Service | Rating | The sticking point |
|---|---|---|
| Slack | Hard | Only the primary owner can close the team or transfer ownership |
| Shopify | Hard | You must file a data deletion request and provide supporting documents |
| DocuSign | Hard | The procedure varies by account type and privileges |
| Stripe | Easy | Account owners only, and any balance or pending invoice must be settled first |
| PayPal | Medium | Any account limitation and any balance must be resolved before closing |
| Medium | Users report still receiving emails after closing the account | |
| Blogger | Impossible | You can't leave it without deleting the entire Google account |
Read the right-hand column again. None of these obstacles is an IT problem. They are design decisions: tying a service account to an individual rather than to the organization, making the exit conditional on settling a balance, nesting a secondary product inside a main account they really don't want you closing. Every one of those decisions was made by someone who knew what it would produce.
The Slack case deserves another minute, because it touches nearly every SMB. A service account opened in an employee's name becomes an orphan the day that employee leaves. The same trap exists for access keys, domain names, certificates and cloud accounts. The countermeasure isn't sophisticated: open company accounts with a role address rather than a personal one, and keep the list current.
The "limited" rating: when your rights depend on your postal code
Only fourteen services carry the limited rating, but it is the most instructive of the five. Its official definition: sites that only allow you to delete your account if you live in an area with privacy rights, and that require proof that local law covers you.
In other words: the button exists, the code is written, the process works. It is simply disabled for you based on the address declared in your profile. The directory's notes are explicit. Shop Your Way: only California and Virginia residents may file a request. Axios: same thing. The Atlantic: you have to choose between an EEA request and a CCPA request, so between Europe and California. Rakuten sums it up in one sentence: if you are in a region where privacy rights are covered by law, it is as easy as clicking a button, otherwise you have to go through support.
A Quebec executive reading this immediately asks the right question: what about us? Quebec has a law. It is in force. But it doesn't appear in those dropdown menus, which know about Europe, California and Virginia. In practice, exercising a Quebec right with a foreign vendor often starts with explaining to them that the right exists.
This is the direct extension of what we described in our tour of the most privacy-respecting jurisdictions: the law that applies to your data isn't the law of your office, it's the law of where the data is hosted and of the company holding it. The limited rating is the most concrete demonstration of that we have seen.
The other way around: under Law 25, you are the one being rated
Everything above puts you on the customer's side. Switch chairs. One of your clients, a former employee or a candidate you didn't hire writes to you tomorrow asking you to erase their information. What would your business be rated?
A widely circulated shortcut needs correcting here: Law 25 did not create a general right to erasure on request. What the text actually provides is both more precise and, for an SMB, more demanding.
The central obligation isn't even triggered by a request. It is section 23 of the Act respecting the protection of personal information in the private sector: when the purposes for which personal information was collected or used are achieved, the person carrying on an enterprise must destroy or anonymize it. Nobody needs to ask you. The résumé of the candidate you didn't hire four years ago is covered by that sentence, and it is probably still sitting in a mailbox.
Then come the rights your clients can exercise:
- Portability, in the third paragraph of section 27: computerized information collected from the person, and not created or inferred by you, must be communicated to them in a structured, commonly used technological format. The Commission d'accès à l'information confirms it has been in force since 22 September 2024, the last piece of the reform to take effect.
- Rectification, in section 28, which also covers information whose collection, communication or retention is not authorized by law.
- De-indexation and cessation of dissemination, in section 28.1. This is Quebec's famous right to be forgotten, and it is considerably narrower than the nickname suggests: it applies when the dissemination contravenes the law or a court order, or when three cumulative conditions are met, including serious injury to reputation or privacy that must be clearly greater than the public interest. The Commission itself presents it as a right to de-indexation, not as general erasure.
The operational detail to remember sits in section 32, and it is the one that should send you looking at your processes: you have 30 days to answer in writing, and failing to answer within that period, you are deemed to have refused the request. Silence isn't neutral. Silence is a refusal, and a refusal opens the door to an application to the Commission for the examination of a disagreement.
Answering within 30 days assumes you know where the information lives, in which system and since when. That is the kind of thing you settle upstream, when choosing and installing your tools, not the day the request arrives. We build environments where retention and deletion are deliberate settings rather than blind spots: let's talk about your situation.
The directory's blind spots
The directory is useful, not infallible, and you are better off knowing its limits before relying on it for a decision.
It is volunteer work. The entries are written by contributors and reviewed by contributors. A vendor changes its process, and the entry stays stale until someone notices. The rating is a serious indicator, never a contractual guarantee.
Coverage leans consumer. You will find Slack, Shopify, Stripe and DocuSign, but Microsoft, Salesforce, HubSpot, QuickBooks and Atlassian have no entry under their name. The enterprise software heaviest in data is precisely what is missing most.
It isn't legal advice. The directory describes what the vendor allows, not what the law owes you. The two don't always line up, and that is precisely the subject of the limited rating.
The front doors aren't equal. The website is the reference version. The Firefox extension, which changes its icon according to the difficulty of the site you are visiting, is maintained and was updated in May 2026. The project's official Chrome extension, however, has been archived since January 2024 and its repository states outright that it is no longer maintained. As for the Android app published on F-Droid by Amano Team, it is alive and under the LGPL-3.0 licence, but the site explicitly calls it an unofficial app. Useful, as long as you know the project isn't the one signing it.
Finally, closing an account is only half the gesture. Before deleting anything, you need to get your data out, and that is the role of the sibling project JustGetMyData, which applies the same rating grid to access requests. The order of operations matters: retrieve, confirm you have everything, then close. It is the same logic as in our article on backing up Google Workspace and Microsoft 365 data: an account closed without extracting the data first is a lost archive.
What we do with it at Blue Fox
The exit rating belongs in your vendor selection grid, alongside price and features. It has a rare advantage: you can know it before signing, for free, in thirty seconds. A service rated hard isn't disqualified for that alone, but it tells you something about how it sees its relationship with you, and that information has value at the negotiating table.
It is also why we recommend open source tools and client-controlled hosting by default. Not on principle: for reversibility. When the data sits in a database you own, on a server whose access you hold, the question of how you leave no longer comes up in the same terms. There is no button to find, no customer service to convince, no postal code to declare.
A half-day exercise that gives you an honest picture of your exit cost:
- Pull the list of every cloud subscription paid over the last three years, starting from the company credit card statement rather than from memory.
- Look each one up in the directory and note its rating. The missing ones count double: nobody has documented their exit.
- Spot the ones opened in a person's name rather than the organization's, and transfer ownership while that person still works with you.
- Close what is no longer used, retrieving the data first.
- Turn the grid on yourself: how long would you take to answer an erasure request, and who on your side owns it?
The fifth step is the one people forget, and it is the only one governed by law. The first four are hygiene. That one is an obligation.
If the exercise turns up a wider set of subscriptions than expected, or accounts nobody can close, let's talk about your exit cost.
Sources
- JustDeleteMe: the public directory, its ratings and its per-service entries.
- jdm-contrib/jdm on GitHub: the repository that feeds the site, under the MIT licence, and the data file the 2,596 services and their rating breakdown come from.
- jdm-contrib contributing guide: the official definition of the five ratings, including "limited".
- justdeleteme/justdelete.me: Robb Lewis's original repository, whose last commit dates from 18 July 2017.
- JustGetMyData: the sibling project, devoted to data access requests.
- JustDeleteMe on addons.mozilla.org: the Firefox extension, version 1.7.0, updated 23 May 2026.
- jdm-contrib/justdelete.me-chrome-extension: the project's Chrome extension, archived and declared no longer maintained.
- Just Delete Me on F-Droid: Amano Team's Android app, under the LGPL-3.0 licence.
- LégisQuébec, chapter P-39.1: the official text of the Act respecting the protection of personal information in the private sector, sections 23, 27, 28, 28.1 and 32.
- Commission d'accès à l'information, right to de-indexation: the regulator's reading of the scope of section 28.1.
- Commission d'accès à l'information, portability: the coming into force of the right to portability on 22 September 2024.