| Data | Kept | Then |
|---|---|---|
| Account (email, handle, name, birth month, country) | until you delete the account + 7 days | anonymised or deleted within 30 days |
| Sign-in codes | 24 hours | deleted |
| Pending teen account without guardian approval | 7 days | deleted |
| Guardian invites | 7 days | deleted |
| Sessions | until expiry + 7 days | deleted |
| Security events (login attempts, denials) | 30 days | deleted |
| Scan photos | 24 hours after processing | deleted from storage |
| Scan results | 90 days | deleted |
| Collection, decks, wants, shares, friends | until you delete them or the account | deleted |
| Trades | until account deletion | anonymised for the other person |
| Reports (moderation) | 1 year after closing | deleted |
| Guardian consent evidence | life of the link + 3 years | deleted |
| AI usage cost records | 13 months | identity removed at deletion |
| Billing records (invoices, payments) | 5 years (tax) | unlinked from your identity at deletion |
| Exports (download files) | 7 days | deleted |
| Server logs (journal, web server with IPs) | 30 days | deleted |
| Application file logs | 14 days | deleted |
| Cloudflare edge logs | per Cloudflare's own retention for our plan | provider deletes |
| Database dumps | 7 days | deleted |
| Encrypted backups (Backblaze B2) | up to about 6 months (14 daily, 8 weekly, 6 monthly) | expire; deletions re-applied after any restore |
Facts verified on the server 2026-11-05: journald 30 days / 4 GB, nginx logs 30 days, project logs 14 days. Backup periods are the server standard (backups.md); not re-verified here.