Data Retention & Deletion Policy
Effective 2026-08-24 · Revised 2026-09-20 · Reviewed annually and on any architecture change touching stored data.
Principles
- Data minimization by architecture — the server stores only what sync and authentication require; user financial content is client-side encrypted and unreadable server-side, so most "retention" concerns an opaque blob.
- Deletion is a code path, not a ticket — in-app account deletion executes the erasure sweep immediately.
- Backups bound erasure latency — every window below feeds the single outer bound we promise: 35 days to disappearance from all copies.
- Your vault is kept until you delete it — inactivity never deletes it (see Dormant accounts).
Retention schedule
| Data class | Window | Deletion path |
|---|---|---|
| Account record (username, password hash, recovery-code hashes) | life of account, including dormancy | removed immediately at deletion |
| Encrypted sync blob, current + prior versions | floor of 3 versions (rollback safety); device-held versions until the hold expires; kept through dormancy | all versions removed immediately at deletion |
| Device registrations (opaque device → version holds) | 90-day dormancy, then removed | swept at deletion |
| Sessions | ≤ 30 minutes; after deletion the account is tombstoned so lingering sessions fail | tombstone at deletion |
| Household invites | until accepted or expired | swept at deletion |
| Bank connections (Plaid) | life of the link; the working credential lives on your device, and a sealed copy (encrypted under a dedicated key) is kept on the server only as a kill switch | the app unlinks at Plaid when you remove a connection or delete the account; the server unlinks it itself, and discards the copy, when the account is dormant (24 months) or deleted |
| Entitlement record (plan id, paid-until, opaque payment-provider ids, bank-link count — never payment details) | life of account | removed immediately at deletion; any live subscription cancelled at the payment provider |
| Prepaid-code store (one-way code hashes + redemption timestamps — never linked to an account or purchase) | life of the service | contains no personal data |
| Access logs (metadata only — never message bodies) | 30 days | ages out |
| Site analytics log (public-page views only: path, status, coarse browser/OS family, referring site's hostname, network registration country, daily pseudonymous visitor number — never an IP address, full user-agent, or query string) | 30 days on the server; anonymous once the daily key is destroyed (at most 24 hours), aggregate statistics kept for trend reporting | ages out |
| Security scan log (vulnerability-probe requests only — URLs that have never existed on this site: probed path, method, source IP address; never triggered by browsing or app use) | 30 days | contains no user data |
| Requested quote symbols (ticker only — never quantities, cost, or account) | server memory only; dropped 24 hours after the last request — never written to disk or logs, never linked to an account | — |
| Aggregate service counters | non-personal aggregates; reset on restart | — |
| Encrypted state backups | 35 days, then destroyed | deleted data absent from all backups after the window |
| Provider disk snapshots | 7 rolling days | ages out |
Dormant accounts
An account with no sign-in and no sync for 24 months is dormant. Dormancy sweeps only what serves the service, not you: device registrations (90-day window above), sessions and expired invites, and each linked bank connection is removed at Plaid so nothing keeps billing behind an abandoned account. The vault itself is kept: it is your own long-term financial record, held at your direction, unreadable to us (client-side encrypted), and deletable in-app at any time. That is the legitimate business need under the FTC Safeguards Rule's two-year disposal rule (16 CFR §314.4(c)(6)) — disposing of your only copy of your records would harm the person the rule protects. We collect no email or phone, so there is no outbound dormancy reminder; the account is told at its next sign-in that it was dormant and how to delete it.
Erasure guarantee
At deletion: the account record, every blob version, device registrations, and invites are removed and the account tombstoned immediately; outstanding sessions die within 30 minutes; backup and snapshot copies age out within the 35-day outer bound. Client-side, users can additionally crypto-shred individual content sections (key destruction) without deleting the account.