Legal / Version 2026-10-25-draft
Data Retention Schedule
Draft for counsel review (updated 2026-10-25). Periods in brackets are proposals. The deletion jobs that enforce this schedule are part of the data-controls work (launch plan step 6).
| Data | Kept while your account is open | After you delete your account |
|---|---|---|
| Account and sign-in records | Yes | Deleted within 30 days |
| Household facts (profile) | Yes | Deleted within 30 days |
| Bank and investment data from Plaid | [24] months of history; older transactions deleted | Deleted within 30 days; Plaid access revoked immediately |
| Uploaded documents and extracted text | Until you delete them | Deleted within 30 days |
| Email messages imported by IMAP | [24] months, or until you disconnect email | Deleted within 30 days |
| Mailbox app password | Until you disconnect email | Deleted immediately |
| Vault items | Until you delete them | Deleted immediately |
| Cases, messages, approvals and results | Yes | Deleted within 30 days |
| Audit log of consequential actions | [7] years [counsel: needed?] | Kept, de-linked from your identity where possible |
| Billing and fee records | [7] years (tax and accounting law) | Kept for the same period |
| AI model request logs (ours) | [30] days | Deleted on schedule |
| Server and security logs | [30–90] days | Deleted on schedule |
| Encrypted backups | 35 daily, 8 weekly and 6 monthly snapshots | Older copies age out over approximately six months; offline mirrors update on their next successful sync |
| Unclaimed invitation records | Up to 30 days | Expired/unclaimed records purged by retention jobs |
| Claimed attribution, reward and commission records | Needed to administer the program and resolve reversals | Follows account deletion and applicable payment-record retention |
| Data subject request records | [3] years | Kept to show compliance |
Providers keep their own copies under their terms (for example Plaid keeps connection records under its End User Privacy Policy); see subprocessors.