sociyx / Cleanup
Safety & limits
Cleanup in the sociyx CLI can permanently delete content from your accounts. Here is how you stay in control, and what it cannot promise.
How a deletion is guarded
- Scanning is read-only. Deleting is a separate step.
- Creating a plan freezes your selection, writes an export of exactly those items, and deletes nothing.
- Running a plan is a dry run by default. Real deletion needs an explicit live flag and a confirmation token specific to that plan.
- Before deleting, sociyx checks the token, that the export file is unmodified, that the plan still matches, and that the logged-in account is the plan's account.
- Each item is re-checked against what you previewed. Items edited since then are skipped, not deleted.
- Problems with login, challenges or repeated rate limits stop the job. Nothing is bypassed.
The delete N confirmation
In the guided UI nothing is deleted until you type delete followed by the number of items, for example delete 12, on the Review screen. If the number does not match what you are about to remove, you have a reason to stop.
On the command line the equivalent is the live command printed by the dry run, which carries a token tied to the plan, the account, the item count and a digest of the items.
Make your first real run tiny. Choose filters that match one to three items you have looked at, check the account and the count, and only then scale up.
What cleanup in the sociyx CLI does not do
- Solve or bypass CAPTCHAs, MFA, suspicious-login challenges or rate limits.
- Type your password for you into a login page. You log in yourself.
- Delete other people's content, or work on accounts you do not own.
- Send data anywhere except the platforms you choose to use (plus Bluesky identity lookups).
- Collect telemetry, require a sociyx account, or use AI to decide what to delete in the CLI cleanup features.
- Claim that your history has been completely wiped.
What sociyx cannot do
- Reach everything. Platforms do not expose a complete history. Some old items may never be listed, and reports cover only the items in your plan.
- Delete copies it does not control. Other people's quotes and screenshots, caches, search engines, archives, and federated copies on other servers.
- Undo. The export is a record of what you removed, not a restore.
- Confirm every delete. Some platforms do not let it check afterwards, which is why results are split into verified and unverified.
Risks to your account
Instagram. Because the access is unofficial, automating it can get an account challenged, temporarily blocked, or in the worst case disabled. sociyx paces writes at 30 to 45 seconds with longer breaks and a 200 per day cap, and stops for 24 hours if Instagram signals a block. That lowers the risk. It does not remove it, and the decision to accept it is yours.
Bluesky and Mastodon. These use the platforms' public APIs and respect the rate limits they publish. They are still early and have not been run end to end on a real account. Treat the first live run as a test.
Alpha software. The current alpha can have bugs. The automated tests use mock servers, not real ones, so they show the code behaves as designed, not that every platform behaves the same way. See what was tested and how.
Handling your credentials
Everything lives in one private folder, usually ~/.local/share/sociyx, created with owner-only permissions. The secrets folder inside it holds session tokens and browser profiles, which are equivalent to being logged in, so treat them like passwords. Back this folder up only to places you trust, and never commit it to a repository.
Never paste passwords, app passwords, tokens, session files or browser profile contents into a chat, an issue or a pull request. Type secrets only at sociyx's local hidden prompt or on the platform's own login page. Error output has token-shaped strings scrubbed, but that is best effort, so read output before sharing it.
To remove everything: run sociyx logout for each account, then delete the folder. Full steps are in the security policy, which also explains how to report a vulnerability.