Currently, when disconnecting an account, the user is prompted with a message that tells them their browsing data won't be removed from the device—and gives them no option to do so. At the very least, point them to the Privacy option to do so.

This is kinda the mirror image of the problems we've discussed around Clear Private Data — there needs to be a strong intersection between these two features, and right now that's not the case. If we don't fix this properly in v1 (and I can imagine that being the case, because we do this badly on desktop and Android, too), then I'd certainly like to explore simple solutions to this specific bug. Happy to discuss further, and/or dig up the last wall of text I wrote on the topic.

Karen and I want to revisit this after v1. In the short-term, let's build a rickety bridge to smooth this out some. Robin, can you spend a very small amount of time on the simplest possible mocks?

Demoting from 1.1 moving to +

I guess the real question here is, "Why don't we clear the data if the user logs out?". If you never sign in, your data stays local until you 'Clear Private Data'. But I think if you sign in, you're willingly connecting your account and the data associated with it. The assumption that you would be clearing that data if you Log Out could be a safe one. Is this something we can do? Can we clear all data if the user logs out? It would also make for a much cleaner string. Something like this: http://c.tecgirl.com/dLdL

There are a few different sets of user behavior that all intersect with accounts and clear private data. * I want to keep this device how it is, but I want to turn off Sync. That might be because it just used up all of my data plan, I might be traveling, I might be tethering so I'm on "pseudo-wifi", I might have hit a bug and I want to stop using it permanently. * I want to disconnect from Sync temporarily so I can reconnect to the same account, perhaps to force a full re-sync (because we no longer expose Reset Sync). Probably I want to keep my local data and re-merge -- perhaps the server doesn't have it all! * I'm switching accounts. Perhaps I want to take the data on this device with me (I changed email addresses), or perhaps I want to start from scratch on this device with whatever is in the new account. * I'm giving away this device. I want to sign out and wipe the local device. (I don't want to wipe the account, though!) This is one of the other-direction problems: when a user clears private data while signed in to Sync, we need to ask if it should also wipe other devices, or if they really mean to sign out and wipe this device. There are also two parts of user expectation that a naïve "clear on disconnect" doesn't touch: * I want to keep all of the information the device had before signing in -- that is, Sign Out is the opposite of Sign In. We're mostly unable to do this, with some exceptions, but communicating that is hard. * What happens if you're not syncing, say, history? Do we clear it or not? If not, you're left with a weird partial profile. These are not exhaustive lists! The upshot of these is that we really need to ask the user *something*. * If they clear private data but have Sync set up, we need to ask them if they want to sign-out-then-wipe, or wipe-this-and-other-devices. We have probably hit this once already: Bug 1202810. * If they sign out of Sync, we ought to ask them if they want to wipe everything locally, wipe only the stuff they synced, or wipe nothing. And finally, we might consider having a pause button for Sync to discourage users from signing out. But that's another story :)

Some history: Bug 578694, Bug 735532, Bug 833902, Bug 833044.

Created Aha card: FIOS-226 - Improve "Clear Private Data"

Bug 1225224 is now the work associated with CPD. (Much more important, IMO.) This bug is for the other direction.

New string for dialog that appears when user Clears Private Data when connected to Sync: [This will clear all selected data but will not delete saved bookmarks and top sites.] [Cancel][OK]

(In reply to Robin Andersen [:tecgirl] from comment #9) > [This will clear all selected data but will not delete saved bookmarks and > top sites.] On a related note, we probably need _some_ way to bulk-delete bookmarks. There's no way to do it right now. I think the current situation is the legacy of desktop's "clear history on exit" feature, which grew to include all the stuff that the browser might save automatically for you, including form fields, cookies, and passwords. When we're using Clear Private Data in relation to signing out, we're using it as a fine-grained profile cleanout, not to discard accumulated history, so I think we should include bookmarks as an option. The alternative is that the user needs to uninstall and reinstall the app, and that's an opportunity to lose a user. What do you think, Robin?

Indeed. I designed Bookmarks Management long ago, and it was never built. https://trello.com/c/aey69DZT/109-improve-bookmarks-management I agree that we should include Bookmarks as one of the options, but last in the list, and possibly with a new warning that would state something like "Are you sure? You will be removing all of your Bookmarks from all of your devices". (obv something better than that)

(In reply to Robin Andersen [:tecgirl] from comment #11) > I agree that we should include Bookmarks as one of the options, but last in > the list… Aye, and probably unchecked by default would do the trick; I think we do something like that for CPD on Android, if I remember right.