diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index a9a780c6..45022707 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - feature/clean-old-tokens
 
 jobs:
   dev-deploy:
diff --git a/coffeecard/CoffeeCard.Library/Services/v2/AccountService.cs b/coffeecard/CoffeeCard.Library/Services/v2/AccountService.cs
index 6ffb52bd..cfb738ae 100644
--- a/coffeecard/CoffeeCard.Library/Services/v2/AccountService.cs
+++ b/coffeecard/CoffeeCard.Library/Services/v2/AccountService.cs
@@ -202,6 +202,7 @@ private async Task AnonymizeUserAsync(User user)
             user.DateUpdated = DateTime.UtcNow;
             user.PrivacyActivated = true;
             user.UserState = UserState.Deleted;
+            await _tokenServiceV2.DeleteTokensByUserAsync(user);
             await _context.SaveChangesAsync();
         }
 
diff --git a/coffeecard/CoffeeCard.Library/Services/v2/ITokenService.cs b/coffeecard/CoffeeCard.Library/Services/v2/ITokenService.cs
index 3df58ac4..c3be4e9a 100644
--- a/coffeecard/CoffeeCard.Library/Services/v2/ITokenService.cs
+++ b/coffeecard/CoffeeCard.Library/Services/v2/ITokenService.cs
@@ -1,3 +1,5 @@
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
 using System.Threading.Tasks;
 using CoffeeCard.Models.Entities;
 
@@ -8,5 +10,9 @@ public interface ITokenService
         Task<string> GenerateMagicLinkToken(User user);
         Task<string> GenerateRefreshTokenAsync(User user);
         Task<Token> GetValidTokenByHashAsync(string tokenString);
+
+        Task DeleteTokenAsync(Token token);
+
+        Task DeleteTokensByUserAsync(User user);
     }
 }
\ No newline at end of file
diff --git a/coffeecard/CoffeeCard.Library/Services/v2/TokenService.cs b/coffeecard/CoffeeCard.Library/Services/v2/TokenService.cs
index 8c960323..0d83c669 100644
--- a/coffeecard/CoffeeCard.Library/Services/v2/TokenService.cs
+++ b/coffeecard/CoffeeCard.Library/Services/v2/TokenService.cs
@@ -1,4 +1,6 @@
 using System;
+using System.Collections.Generic;
+using System.Collections.ObjectModel;
 using System.Linq;
 using System.Threading.Tasks;
 using CoffeeCard.Common.Errors;
@@ -51,4 +53,16 @@ public async Task<Token> GetValidTokenByHashAsync(string tokenString)
         }
         return foundToken;
     }
+
+    public async Task DeleteTokensByUserAsync(User user)
+    {
+        var tokens = await _context.Tokens.Where(t => t.UserId == user.Id).ExecuteDeleteAsync();
+        await _context.SaveChangesAsync();
+    }
+
+    public async Task DeleteTokenAsync(Token token)
+    {
+        _context.Tokens.Remove(token);
+        await _context.SaveChangesAsync();
+    }
 }
\ No newline at end of file
diff --git a/infrastructure/core.bicep b/infrastructure/core.bicep
index 614f2c69..21e62340 100644
--- a/infrastructure/core.bicep
+++ b/infrastructure/core.bicep
@@ -56,6 +56,18 @@ module webapp 'modules/webapp.bicep' = {
   }
 }
 
+module functionApp 'modules/functionApp.bicep' = {
+  name: '${deployment().name}-function-app'
+  scope: resourceGroup(sharedResourceGroupName)
+  params: {
+    environment: environment
+    location: location
+    organizationPrefix: organizationPrefix
+    sharedResourcesAbbreviation: sharedResourcesAbbreviation
+    hostingPlanId: appservicePlan.id
+  }
+}
+
 module sqlDb 'modules/sqldatabase.bicep' = {
   name: '${deployment().name}-${applicationPrefix}-sqldb'
   params: {
diff --git a/infrastructure/modules/functionApp.bicep b/infrastructure/modules/functionApp.bicep
new file mode 100644
index 00000000..0fa3b3ad
--- /dev/null
+++ b/infrastructure/modules/functionApp.bicep
@@ -0,0 +1,34 @@
+@allowed(['dev', 'prd'])
+param environment string
+param location string
+
+param organizationPrefix string
+param sharedResourcesAbbreviation string
+param hostingPlanId string
+
+resource functionApp 'Microsoft.Web/sites@2021-03-01' = {
+  name: 'func-${organizationPrefix}-${sharedResourcesAbbreviation}-${environment}'
+  location: location
+  kind: 'functionapp'
+  identity: {
+    type: 'SystemAssigned'
+  }
+  properties: {
+    serverFarmId: hostingPlanId
+    siteConfig: {
+      appSettings: [
+        {
+          name: 'FUNCTIONS_WORKER_RUNTIME'
+          value: 'dotnet'
+        }
+        {
+          name: 'FUNCTIONS_EXTENSION_VERSION'
+          value: '~4'
+        }
+      ]
+      ftpsState: 'FtpsOnly'
+      minTlsVersion: '1.2'
+    }
+    httpsOnly: true
+  }
+}