One button produces one file with everything in it.
Settings, then Privacy, then the button marked Export my data. There is no request form, no support ticket, no export fee, and no plan that withholds it, including the free one. There is also no queue and no overnight job: the export is one request that returns the file, so how long it takes is how long your browser takes to save it.
Plus your full profile row.
Indented, one file, named for the date you ran it.
Per account. It reads a lot of tables at once.
An older session is asked for your password again first, then the download retries.
The file starts with a manifest
Before any data, the export writes a list of every table it included and how many rows it found in each. That is deliberate: a count of zero is visible, and a table that is missing from the list is missing on purpose rather than by accident. You can check the export against this page without opening a single record.
It is an archive, not a restore
The file says so itself. Every export carries this note, and we quote it here rather than paraphrasing it:
This file is human-readable and machine-parseable; there is no automated re-import path today, so treat it as an archive/backup rather than a one-click restore.
Every table it reads, named
Grouped for reading. The names are the real table names, so you can match them against the manifest in your own file. Measured August 2026.
Protocols and their history
8protocolsprotocol_stepsprotocol_versionsprotocol_refinementsprotocol_risk_scoresprotocol_complianceprotocol_starsprotocol_templatesRuns, findings and evidence
5findingsfinding_linksevidenceprotocol_test_runssimulation_runsLab notebook
6notebooksnotebook_entriesnotebook_entry_versionsnotebook_entry_signaturesnotebook_entry_refsnotebook_collectionsInventory and reagents
3inventory_itemsinventory_transactionsreagentsProjects and literature
5projectsproject_memberspaperspaper_collectionspaper_collection_itemsAnalysis
6image_analysesstat_analysesanalysis_templatessaved_recipessaved_sample_size_calcscustom_toolsAssistant conversations
2conversationsmessagesStandards
2standards_finder_resultsstandards_bookmarksFiles, comments, calendar and support
4commentscalendar_eventsfilessupport_ticketsTeams, follows and notifications
5organizationsorganization_membersuser_followsnotificationslims_notificationsLIMS records you own or authored
5lims_orderslims_invoiceslims_messageslims_providerslims_provider_membersBounties
2bountiesbounty_submissionsEngineering records
2eng_recordseng_verificationsEducation workspace
8education_schoolseducation_school_memberseducation_class_memberseducation_assignmentseducation_rubricseducation_project_memberseducation_educator_profileseducation_ai_runsYour own security history
2login_historyaudit_logWhat each kind of data comes out as.
The account export is the whole account at once. Counting it, 32 endpoints hand the browser a file, between them covering 10 distinct formats: CSV, FHIR R4 JSON, HL7 v2.5.1, HTML, ICS, JSON, Markdown, PDF, Plain text, X12 837P. This table says which of them applies to what, and names the one place where the answer is that nothing does.
Protocols
One protocol at a time through the export route, in whichever of the five formats you ask for. Markdown is the one to take if you intend to keep editing it somewhere else. The account export carries every protocol at once as JSON, including the step graph and the version history.
protocolsprotocol_stepsprotocol_versionsTest runs
The session report is a PDF: steps, timings, notes, pass and fail and deviation. The underlying run rows, including the per-step record, come out as JSON in the account export.
protocol_test_runssimulation_runsFindings and evidence
JSON rows in the account export. Evidence rows carry the link to the uploaded file rather than the file itself, so the attachment is fetched separately.
findingsfinding_linksevidenceNotebook entries
A PDF per entry, with the signature footer. The account export carries the entry blocks as JSON, which is the editable form, plus every prior version and every signature.
notebook_entriesnotebook_entry_versionsnotebook_entry_signaturesDatasets
Nothing today. Saved plate and tabular datasets have no download route, and the account export does not read the table they live in. This is a gap, not a policy.
LIMS records
The widest set of formats in the product, because a lab record has to arrive somewhere that is not Olto. Results as CSV, certificates and invoices as PDF, and the same results as an HL7 v2.5.1 result message, a FHIR R4 bundle, or an X12 837P claim. Every builder is deterministic, so the same order yields byte-identical output each time.
lims_orderslims_invoiceslims_messagesUploaded files
The original bytes, unchanged, one file at a time through a short-lived signed link. There is no bulk archive. The account export carries the file records, meaning the name, the type, the size and the storage path, not the contents.
filesAssistant conversations
PDF or Markdown per conversation, including each assistant turn’s tool activity: what it searched, what it read, and which of your own records it cited.
conversationsmessagesEngineering and metrology records
One PDF per instrument, each printing the inputs alongside the result so the number can be re-derived by hand. The sealed verification record carries its SHA-256, which you can recompute from the same content without us.
eng_recordseng_verificationsVerity reports
PDF or JSON per completed report. The JSON is the full stored report, including the engine version and the engine fingerprint the result was produced under. These reports are not part of the account export.
Team audit log
CSV or PDF for a team you administer. Your own login history and your own audit rows are in the account export as well, because the export is meant to be everything held about you rather than everything convenient to hand over.
audit_loglogin_historyBilling and usage
CSV or PDF. Invoices themselves live with the payment processor and are reached from the billing portal.
Class records
Class progress as a gradebook-pasteable CSV, and the class calendar as ICS. A teacher only ever exports a class they manage.
education_assignmentseducation_rubricseducation_class_membersSeparately, 40+ analysis and lab screens build a CSV in the page and hand it straight to the browser. Those never reach a server, so there is no request to rate-limit and nothing to ask permission for.
What happens to a published Passport when you go.
A Passport is a public, citable URL. That is the point of it, and it is also the part of leaving that people are right to ask about, because a citation someone else has printed is not yours to take back. Here is exactly what breaks, what persists, and what was never in our gift.
You unpublish the protocol
The Passport URL returns 404 from that moment. The page, the JSON manifest and the PDF all read the protocol through the same public flag, so all three stop serving together. The page also tells search engines not to index the missing record. The sitemap regenerates hourly and lists only public, active protocols, so the URL drops out of the next build.
You delete the account
The protocol row is removed by a cascade from your authentication record. The Passport returns 404 for the same reason as above, and there is no state in which it comes back. Republishing later means a new protocol and a new URL.
What stays public either way
Every copy someone else already took. A downloaded Passport PDF, a saved JSON manifest, an embedded badge image cached by whoever embedded it, and any third-party search index that crawled the page. None of those are ours to withdraw, and we will not claim otherwise.
Forks stay with the person who forked them
A fork is a separate protocol owned by the scientist who made it, not a view of yours. When your row goes, their copy survives and its pointer back to your protocol is set to null. You cannot withdraw a fork, and unpublishing does not retract one.
The permalink is an Olto URL, not a DOI
DOI minting is built but dormant: it is gated on registration-agency credentials that are not configured, so no Passport carries a registered DOI and none is claimed to. A Passport URL therefore depends on this domain continuing to resolve. If you need an identifier that does not, take the Fingerprint and the Capsule instead.
The two identifiers that survive us
The Reproducibility Fingerprint is content-addressed: anyone holding the protocol text can re-derive the same id with no account and no server. The Capsule encodes the whole protocol as one string that decodes offline and recomputes its own fingerprint, so a corrupted or altered copy is detectable by the person holding it. Both work if Olto is gone.
The Fingerprint is specified in public at the Fingerprint spec, and you can watch it run on your own text at the Fingerprint page. Neither needs an account, and neither needs us.
How the delete works, in the order it happens.
Settings, then Security, then the danger zone. You type the word DELETE. If you have multi-factor authentication enabled you must already be at your second factor to reach the operation at all. Export first: there is no undo, and support cannot reverse it for you.
Three checks run first, and can stop it
Deletion is refused, with the reason, if you own a team that still has other members, if you run a lab in the LIMS that still has orders against it, or if you have a bounty with funds in escrow. Nothing has been changed at that point. Transfer or resolve the blocker and run it again.
References to you on records that survive are cleared
Rows other people keep stop pointing at you: the invited-by on a team membership, the added-by on a project membership, the approver on a protocol, the resolver on a comment. Invitations you sent or received are deleted outright.
A team or lab you own alone is removed
Having passed the checks, an organization you created with no other members is deleted, along with its memberships, invitations, calendar and projects. So is a LIMS provider you own that has no orders.
Any active subscription is cancelled
Cancellation is issued to the payment processor before the account goes, so a deleted account is not billed again.
The authentication record is deleted, and your rows cascade with it
This is the irreversible step. Deleting the auth user removes your rows across the schema by foreign-key cascade and clears every session, identity and multi-factor enrolment.
Uploads and your avatar are removed from storage
Storage objects carry no foreign key, so they are deleted explicitly: your files in the research bucket, and your avatar in the public one, which would otherwise survive at its public URL.
One record is written, not removed
A single audit entry records that an account was deleted. It is written with no user id, because the user no longer exists, and carries the former account identifier in its metadata. It exists so a deletion cannot be performed and then denied, which is the same reason the rest of the audit trail exists. It is the only row the deletion writes rather than removes.
What is retained, and for how long.
This is the part most exit pages get vague about, so read the specific claim rather than the tone of it. One retention period is committed to as a number. The rest are not, and we are not going to invent figures here that the privacy notice does not carry.
Billing records: at least seven years
Kept to meet tax obligations. This is the only retention period the privacy notice states as a figure, and it is a legal floor rather than a preference.
Account data, content, logs and backups
Account information is held for a period after deletion to allow recovery and meet legal obligations. Content is removed from active systems within a reasonable period. Encrypted backups persist until the rotation overwrites them. Security and audit logs are held for a bounded period that depends on the event. None of those four periods is published as a number, so do not plan around one.
Anything already sent to the model provider
Olto is not end-to-end encrypted. Prompts, files submitted for AI processing and assistant conversations reach our inference provider to produce a response, and their retention is governed by their API terms rather than by ours. Deleting your Olto account does not reach into their systems. That content is not used to train Olto-owned or public models.
A rights request gets a reply in 30 days
Access, correction, deletion, portability, restriction and objection can all be exercised by email, with a response within 30 days where applicable law requires one. The self-serve export and delete above cover portability and erasure without waiting for us.
The authoritative wording for all of this is the privacy notice. Where this page and that page disagree, that page governs and this one is the bug.
What you cannot take with you.
An exit page that lists only what works is an advertisement. These are the places where the answer is no, or not yet, as of the same measurement date as everything above.
A restore
There is no automated re-import. The export is designed to be read by you and by other software, not to be loaded back into Olto by clicking something. If you leave and return, you start a new account and bring your records back the way you would bring them into any other system.
A programmatic sync
There is no public API. You cannot schedule a nightly pull into your own store, and you cannot script the export. Everything on this page is something a person clicks. The internal developer console is not a public interface, whatever its name suggests.
Your uploaded files in one archive
Files come out one at a time, as the original bytes, through a link that is valid for 5 minutes. The account export carries the file records, meaning the name, type, size and storage path, but not the contents. A library of a few hundred attachments is a few hundred clicks.
Saved datasets, which the account export does not read
Plate and tabular measurement data saved from the data workbench, together with the well map, the analysis options and the computed result. Nothing. There is no per-record download for a saved dataset and the account export does not read this table, so the only copy that leaves Olto today is the instrument file you started from. If this matters to you, keep that file.
datasetsVerity reports, which the account export does not read
Completed Verity precision-medicine reports: the variant call, the evidence set, the therapeutic read and the target dossier. Each completed report downloads on its own as a PDF or as JSON, from the report itself. The account export does not collect them, so a report you want to keep is a report you download.
verity_variant_reportsverity_evidence_reportsverity_therapeutic_reportsverity_dossier_reportsMolecular-pathology case records, which the account export does not read
Molecular-pathology case records: the case, its workups, the locked classifications, the sign-off attestations and the evidence citations behind them. A workup downloads as a PDF from the case. The case record itself, its audit events and its attestations stay in the database.
pm_casespm_workupspm_classificationspm_attestationspm_evidence_citationsRows that are not yours
The export filters every table on the column that ties a row to you. A protocol a teammate owns and shared with the team is theirs, not yours. A class you are enrolled in but do not manage exports for its teacher. A LIMS order exports for the requester who placed it, so orders you ran as the provider are not in your file. This is a boundary, not an oversight, but it does mean your export is smaller than what you can see on screen.
Operational metering, excluded on purpose
9 tables are deliberately left out on the grounds that they are meters rather than records you made. They are named here so the omission is a decision you can see and disagree with, rather than one you discover by noticing a gap.
ai_callsai_spendusage_eventsusage_limitsweb_vitalsserver_errorssubscription_eventsprotocol_presencepromo_redemptionsEvery figure on this page is derived from the export code itself and pinned to it by a test, so adding a table, a format or a route fails the build until this page agrees with reality. If you find something here that the product contradicts, that is a defect and we want to hear about it.