What I Would Do If I Ran Tarsnap

"Operating on pre-payment is kind of nutty."

Not if you reconsider "backup for the truly paranoid" and ponder about who actually IS the paranoid and what he is paranoid about. Could it be him being paranoid about not wanting to run after his customers money for a service that already has been provided?

He could just not stress about running after his customers and chalk it up to breakage. Probably not a good use of his time to be chasing after them for a couple of dollars.

rm -rf after 14 days is a bit severe. There is a middle ground where you deny access to the service, but don't delete the data. Note that this is a timeline not set by the customer's "delete if you haven't heard from me by X", but by a billing system set up around unpredictable costings.

Besides, even the truly paranoid don't know when they're going to lose access to emails for two weeks. Sudden hospitalisation? Travelling in an internet poor area, and your hotel that promised access was 'down'? Temporary incarceration for something you never did? Death of a loved one that puts you out of your normal life procedures? Or just fat-fingering a command because you're human, and missing out on the email from an accidental bulk delete (or similar). Perhaps change it to an opt-in for the truly paranoid: "If you're uncontactable for two weeks and our billing system decides you're out, delete my data rather than merely revoke access".

After all, if you're really after a 'dead-man switch', then that should be a feature on it's own, not something to do with billing. "If I haven't logged in for -foo- weeks, delete my data". That's clearly a dead-man switch, not a proxy analogue conducted via "we've consumed what's left on your account". Plus the user could set the number of weeks, rather than just "some unpredictable future time".

What about 28 days? :-)