In the app, confirm with DELETE and use POST /api/account/request-deletion.
Without access to the app, use POST /api/account/public-deletion-request with email and confirmation:"DELETE"; this route records the request and requires identity verification.
Minimal financial retention: minimal financial records may be preserved when required by law, security, or reconciliation.