[oaiey]

Imho: GDPR allows keeping if required by law. E.g. for long term archival of accounting information for tax reasons. That information, in some systems, might be the same as the user account itself and therefore might be totally acceptable. However, in that sample there is no reason to keep your password and your preferences or non-anonymzed stats.