Data Retention & Deletion Policy
Effective 2026-07-19 · Reviewed annually and on any architecture change touching stored data.
Principles
- Data minimization by architecture — the server stores only what sync and authentication require; user financial content is client-side encrypted and unreadable server-side, so most "retention" concerns an opaque blob.
- Deletion is a code path, not a ticket — in-app account deletion executes the erasure sweep immediately.
- Backups bound erasure latency — every window below feeds the single outer bound we promise: 35 days to disappearance from all copies.
Retention schedule
| Data class | Window | Deletion path |
|---|---|---|
| Account record (username, password hash, recovery-code hashes) | life of account | removed immediately at deletion |
| Encrypted sync blob, current + prior versions | floor of 3 versions (rollback safety); device-held versions until the hold expires | all versions removed immediately at deletion |
| Device registrations (opaque device → version holds) | 90-day dormancy, then removed | swept at deletion |
| Sessions | ≤ 30 minutes; after deletion the account is tombstoned so lingering sessions fail | tombstone at deletion |
| Household invites | until accepted or expired | swept at deletion |
| Bank connections (Plaid) | life of the link; the credential lives on your device | unlinked at account deletion |
| Entitlement record (plan id, paid-until, opaque payment-provider ids, bank-link count — never payment details) | life of account | removed immediately at deletion; any live subscription cancelled at the payment provider |
| Prepaid-code store (one-way code hashes + redemption timestamps — never linked to an account or purchase) | life of the service | contains no personal data |
| Access logs (metadata only — never message bodies) | 30 days | ages out |
| Aggregate service counters | non-personal aggregates; reset on restart | — |
| Encrypted state backups | 35 days, then destroyed | deleted data absent from all backups after the window |
| Provider disk snapshots | 7 rolling days | ages out |
Erasure guarantee
At deletion: the account record, every blob version, device registrations, and invites are removed and the account tombstoned immediately; outstanding sessions die within 30 minutes; backup and snapshot copies age out within the 35-day outer bound. Client-side, users can additionally crypto-shred individual content sections (key destruction) without deleting the account.