Retention and Deletion Policy
1. How long we keep data
| Data | Kept |
|---|---|
| Account (email, password hash, verification, terms acceptances) | Until you delete the account. |
| Projects, revisions and document history, maintenance records, inventory, tasks | Until you delete the project or the account. We do not delete inactive projects on our own. |
| Photos | Until you delete the photo, its project or the account. |
| Manuals you uploaded to a project | Until you delete the manual. [Engineering note: deleting a project does not yet remove its uploaded manuals — fixed before launch, after which they go with the project.] |
| Cached candidate designs (your design description and the designs shown to you) | Short-lived; older entries are discarded automatically as new ones are made. |
| Billing records (plan, Stripe references and events) | Your plan status until you delete the account; records needed for tax and accounting for [period required by law]. Stripe keeps its own records under its policy. |
| Server logs and error reports | [30 days], then deleted. |
| Backups | Database and file backups roll off after [30 days]. [Engineering note: nightly off-site backups are being put in place; confirm the window and encryption at rest before publication.] |
| Data sent to Anthropic by an AI feature | We do not store it beyond the results saved to your project; Anthropic’s retention is set by its commercial terms. |
2. Deleting a project
Deleting a project from the app is a hard delete, not a hidden flag: the project, its revisions and document history, its maintenance and inventory records and its photos are removed from the live database and file storage at once. It cannot be undone. Copies remain only in backups until those roll off.
3. Deleting your account
From account settings, confirm your password and delete the account. This is a hard delete that cascades: every project you own (as above) → any remaining photos you uploaded → your billing status → your email-link tokens, verification and terms-acceptance records → the account itself. You are signed out everywhere. Cancel any paid subscription first (the app links you to Stripe’s billing portal); deleting the account does not by itself refund a payment.
Backups containing your data roll off within [30 days]. If we ever have to restore a backup, we re-apply deletions made since it was taken. [Engineering note: the restore procedure must include this step before publication.]
4. Export before you go
Account settings has Export my data: one JSON file with your account details (never the password hash), every project you own in full, your photo records and your billing status. Each project’s documents (schedule, drawings, bill of materials and the rest) can also be downloaded from its Documents page.