Data and retention

Captures purge 13 months after capture; takedown hides immediately and purges within 72h. Missing data is reported as not observed, never zero.

Your workspace content

A verified deletion request revokes access immediately: shares, API keys and reads stop at once. Active content is deleted 7 days after verification and expires from backups 30 days after verification. After a non-renewed term ends, access and active content end 30 days later and backups expire 21 days after that. Deletion tombstones are kept so a restore can never resurrect removed content; audit entries keep content-free fields for 90 days. Billing records follow the statutory schedule.

Early-access sign-ups

Each feature has its own consented list. We store the normalized email, brand, optional website and note, role, language, source, consent version and time, and confirmation time. In-app sign-ups also record the account and workspace. Unconfirmed sign-ups are deleted after seven days. Unsubscribing deletes the sign-up immediately; an operator can also delete it on request. Confirmed rows are deleted twelve calendar months after that feature launches. The scheduled intake cleanup enforces these deadlines, and workspace deletion covers linked sign-ups. Each email includes an unsubscribe link. Daily abuse counters hold only keyed hashes, with a two-day lifetime. Operator exports and launch actions are logged without recipient details.