The Off-Key Bard
Technology

What Happens to Your Data When a Company Goes Out of Business?

Or: the app may disappear. Your information might not. When a company shuts down, its data doesn't automatically shut down with it.

Or: The App May Disappear. Your Information Might Not.

You sign up for an app. Create an account. Upload photos, enter your email, your birthday, maybe your payment information. Years pass. Then one morning you get an email: "We're shutting down."

The app disappears. The website goes offline. Company gone.

So what happens to everything you gave them? Does somebody press DELETE ALL USERS on the way out the door?

Not necessarily. When a company disappears, its data doesn't automatically disappear with it.

What "Your Data" Actually Includes

Most people think about the obvious things — photos, documents, messages. But companies may hold considerably more information associated with an account: name, email, phone number, device information, login records, IP addresses, purchase history, support conversations, location history, usage patterns, and advertising profiles built up over years of use.

The files you intentionally uploaded are only one category. The company's picture of you may be much larger than the picture you deliberately painted.

The Best Case: An Orderly Exit

The most graceful ending looks like this: the company announces it's shutting down in 90 days, provides an export tool, and gives users time to retrieve their photos, documents, messages, and account records. Then everything shuts down cleanly.

This does happen. But it requires the company to have enough runway — time, money, and operational capacity — to manage its own death carefully. Businesses don't always get that. Cash can run out abruptly. Creditors can take action before the company is ready. Cloud bills stop getting paid and infrastructure can evaporate quickly. A company may genuinely want to give customers months of warning and still not have the resources to do it.

The lesson for users is not to wait. If a shutdown is announced, "I'll download everything later" is a plan with a deadline attached.

What Happens During an Acquisition

When a company is bought rather than simply shuttered, the situation gets more complicated. The acquiring company purchased something — technology, employees, brand, customer relationships. Customer databases can be among the assets that change hands.

That doesn't give the buyer unlimited permission to do whatever it wants with the information. Privacy laws, prior contracts, and existing policies can place restrictions on how data is handled post-acquisition. But the database didn't disappear when the sign changed. A company shutting down its operations and a company being acquired are different situations that play out very differently for user data.

The privacy policy paragraph about mergers, acquisitions, and asset sales that everyone skips? That's the part that governs this situation.

What Bankruptcy Does

Bankruptcy makes things more complicated still. A failing company typically has assets that can be sold to pay creditors. Those assets can include intellectual property, equipment, brand names — and potentially customer databases.

This has played out in public enough times to be instructive. When RadioShack went bankrupt in 2015, the FTC intervened to urge the bankruptcy court to protect customer information, pointing to the company's own privacy promises about not selling customer data. When Borders failed in 2011, the FTC similarly weighed in on how customer purchase histories could be handled. When 23andMe filed for bankruptcy in 2025, state attorneys general urged customers to consider deleting their accounts and requesting genetic data destruction before the proceedings concluded — because genetic information is particularly sensitive and the bankruptcy created real uncertainty about who would end up controlling it.

In each case, the core tension was the same: information that had value to the business also had value to potential buyers, and customers who had provided that information under certain privacy promises were now watching those commitments get tested in court.

The Copies Problem

Even in orderly shutdowns where a company genuinely deletes its databases, the situation is more complex than it appears.

Companies make backups. An organization might delete your information from its active systems while older copies exist in backup storage, scheduled to age out according to retention policies. "Deleted" doesn't always mean every physical copy vanished instantly — it often means removed from active use, with backup copies expiring on their own schedule.

Then there's the information that left the company's systems entirely before the shutdown. If the company participated in data sharing, advertising networks, or sold information to data brokers, those downstream copies don't get recalled when the original company disappears. Deleting the source doesn't delete the copies that already traveled somewhere else. Think of emailing someone a photo and then deleting your original — their copy isn't affected.

Legal requirements can also mandate that certain records persist regardless of shutdown. Tax records, financial transaction logs, fraud investigation records — some information needs to be retained for legitimate legal and regulatory reasons even when the rest of the account is deleted.

What Happens to Things You "Bought"

Digital purchases add another layer. If you bought ebooks, movies, music, or games tied to a company's service, the question of what you actually own becomes meaningful when that company disappears.

A physical book works without the bookstore remaining in business. A digital purchase that depends on account authentication or the company's servers to verify ownership is different. Whether you have a file you can use independently or a license tied to infrastructure that may go offline determines what survives. Good services plan for this — some remove DRM before shutting down, some transfer licenses, some provide download options. Others don't, and purchases become inaccessible.

The same logic applies to smart devices that depend on company servers. The hardware sitting in your home may be perfectly functional while the infrastructure it requires to operate stops existing. This is worth understanding before buying products whose core features live in someone else's cloud.

What You Can Actually Do

You can't guarantee that every company you use will exist indefinitely. But you can reduce the impact if one disappears.

For anything irreplaceable — family photos, important documents, creative work — don't let one company's service be the only place it exists. If a service offers a data export option, using it occasionally is good practice even when nothing seems wrong. Services that seemed permanent have disappeared before.

It's also worth periodically revisiting accounts you no longer actively use. Services you signed up for years ago and haven't touched since may still hold personal information, payment history, old addresses, and photos. Deleting unused accounts, where practical, reduces how much old information is scattered across organizations you no longer have a relationship with. You can't lose control of information a company no longer has.

Account deletion isn't a guarantee of complete erasure — some records persist for legitimate reasons, and information previously shared elsewhere doesn't disappear — but it meaningfully reduces your exposure at the source.

The Bard's Take

We tend to assume that a company disappearing means its data disappears too. Computers don't work that way. A business can stop existing while its servers, backups, databases, customer records, and contracts remain very real. Sometimes everything is carefully deleted. Sometimes users get months to export their data. Sometimes another company buys the service and its customer database. And sometimes a business collapses quickly enough that the ending is messier than anyone intended.

The important lesson isn't "never trust a company with data" — modern life would make that nearly impossible. It's: don't confuse access with permanence. Your cloud photo library has been there every morning for ten years. But underneath that app is a company paying employees, paying server bills, maintaining software, and running infrastructure. Companies are not immortal.

If something is genuinely irreplaceable, make sure it exists somewhere that doesn't require that company to keep existing too.

Sources

← Back to the Desk — Technology