Revoking access

Explains how to revoke access and what follows.

How to revoke

Open your card. Sign in at https://app.spherum.ae/my/sphere with your own email or phone — the one you sign in with, not the corporate address a company may know you by.

Pick the company. If more than one company holds access, you land on a list of cards, one per company. Revoking lives inside a card rather than on the list: ending access is not something that should be one tap away from a row you were only scrolling past.

Revoke access, and confirm. One button, one confirmation. You do not have to give a reason, and the company is not asked to agree.

Revoking ends one company’s access and nothing else. Your other cards carry on exactly as they were.

Note

There is nothing to revoke on a card you have not granted yet — an unfinished card was never shared with anyone.

What happens next

They stop being served your card at once. In their list you appear as revoked, and opening the card returns nothing but the fact that the source is revoked. Nothing from it is kept on their side.

Spherum stops giving out your details at the source. That is what we can promise and all we promise: a sheet somebody printed while access was live is paper, and paper does not close.

Your token keeps working. A token belongs to you, not to the company that handed it out, so revoking a card does not switch it off. Scanning it still shows your emergency contacts. Turn it off under My tokens, which is a separate decision on purpose.

Thirty days later, their record of you is emptied. The window exists for a revocation you did not mean: inside it, a re-invitation simply reopens the same card. After it, the name and address the company held are cleared, and what is left is the record that you granted and that you revoked.

Sharing again means granting again. Ask the company to invite you afresh. That reopens your card for editing, and nothing reaches them until you grant access a second time. No previous consent resumes on its own.

What a company can and cannot see sets out what they had while access was live.

Downloading your data

Before you end anything, you can take a copy of it. Account → Download my data builds a file of everything Spherum holds about you and hands it straight to your browser. Nobody has to be asked, and no request has to be made: it is your record, so obtaining it is one button.

The file is JSON — machine-readable, so it can be opened in a text editor, read by a script, or handed to anyone you are giving your data to. It is named with your Spherum ID and the time it was made, and it carries a short section explaining what each part of it means.

What is in it:

• Who you are on file: the email and phone you sign in with, your Spherum ID, and when the file was produced.
• Every card you hold, company by company: its state, when you granted, when access ended if it has, every field value you filled in, the fields you added yourself, and the corporate address that company knows you by, labelled as theirs rather than yours.
• Cards that are revoked, or that the company has archived, the same as live ones. A card that ended is still part of your record.
• The tokens linked to you — listed, never with the key a scan uses.

The file is everything about you in one place, which is the point of it and also the reason to keep it somewhere you would keep anything else of your own.

Deleting your account

Danger

This is the irreversible one. It deletes your account and everything Spherum holds about you, for every company at once. There is no waiting period, no undo, and no copy we can restore afterwards — and it is entirely your decision to make.

Deleting is reached from Account, not from any company’s card: what you are deleting is yours, not theirs. Holding a signed-in session is not enough on its own — a code is sent to your email or your WhatsApp, and you confirm with it. If you have both, you choose which. A borrowed phone or an open tab cannot end an account on your behalf.

What happens in that moment: every company you have granted loses access at once. Your details are erased rather than emptied on a timer. Any token you carry is released — it is a physical object, so it is not destroyed, but scanning it afterwards says it is not active, and it can be linked to someone else later.

What each company keeps is the record that a grant existed and was ended, exactly as an ordinary revocation leaves it. Nobody sees a person vanish from their list, and nobody is told which of the two it was.

Take the download first if you want a copy. Afterwards there is nothing left to export.