diff --git a/dvc/repo/destroy.py b/dvc/repo/destroy.py
--- a/dvc/repo/destroy.py
+++ b/dvc/repo/destroy.py
@@ -3,6 +3,6 @@
 
 def destroy(self):
     for stage in self.stages():
-        stage.remove()
+        stage.remove(remove_outs=False)
 
     shutil.rmtree(self.dvc_dir)
diff --git a/dvc/stage.py b/dvc/stage.py
--- a/dvc/stage.py
+++ b/dvc/stage.py
@@ -296,8 +296,11 @@ def unprotect_outs(self):
         for out in self.outs:
             out.unprotect()
 
-    def remove(self, force=False):
-        self.remove_outs(ignore_remove=True, force=force)
+    def remove(self, force=False, remove_outs=True):
+        if remove_outs:
+            self.remove_outs(ignore_remove=True, force=force)
+        else:
+            self.unprotect_outs()
         os.unlink(self.path)
 
     def reproduce(

@efiop , `destroy` should work as `rm -rf .dvc`?

I was thinking about adding the `--all` option that will work as `rm -rf .dvc *.dvc Dvcfile`.

Is that the expected behavior?
Currently `destroy` removes both .dvc/ directory and *.dvc files with their outputs. Starting from 1.0, it should leave outputs intact(in symlink case, it should remove symlinks and replace them by copies), so that user at least has his data back.
We should use `unprotect` as described in https://github.com/iterative/dvc/issues/1802
diff --git a/tests/func/test_destroy.py b/tests/func/test_destroy.py
--- a/tests/func/test_destroy.py
+++ b/tests/func/test_destroy.py
@@ -1,21 +1,28 @@
 import os
 
-from dvc.main import main
+from dvc.system import System
 
-from tests.func.test_repro import TestRepro
 
+def test_destroy(repo_dir, dvc_repo):
+    # NOTE: using symlink to ensure that data was unprotected after `destroy`
+    dvc_repo.config.set("cache", "type", "symlink")
 
-class TestDestroyNoConfirmation(TestRepro):
-    def test(self):
-        ret = main(["destroy"])
-        self.assertNotEqual(ret, 0)
+    foo_stage, = dvc_repo.add(repo_dir.FOO)
+    data_dir_stage, = dvc_repo.add(repo_dir.DATA_DIR)
 
+    dvc_repo.destroy()
 
-class TestDestroyForce(TestRepro):
-    def test(self):
-        ret = main(["destroy", "-f"])
-        self.assertEqual(ret, 0)
+    assert not os.path.exists(dvc_repo.dvc_dir)
+    assert not os.path.exists(foo_stage.path)
+    assert not os.path.exists(data_dir_stage.path)
 
-        self.assertFalse(os.path.exists(self.dvc.dvc_dir))
-        self.assertFalse(os.path.exists(self.file1_stage))
-        self.assertFalse(os.path.exists(self.file1))
+    assert os.path.isfile(repo_dir.FOO)
+    assert os.path.isdir(repo_dir.DATA_DIR)
+    assert os.path.isfile(repo_dir.DATA)
+    assert os.path.isdir(repo_dir.DATA_SUB_DIR)
+    assert os.path.isfile(repo_dir.DATA_SUB)
+
+    assert not System.is_symlink(repo_dir.FOO)
+    assert not System.is_symlink(repo_dir.DATA_DIR)
+    assert not System.is_symlink(repo_dir.DATA)
+    assert not System.is_symlink(repo_dir.DATA_SUB)

destroy: don't remove data files by default in the workspace
Will have to add some option to destroy data files as well.

tests/func/test_destroy.py::test_destroy