Data Retention and Deletion Policy

Data is retained only while it serves the purpose it was collected for, and retention is bounded rather than indefinite. Every category below has a stated end point, including the copies held in backups, because a deletion that leaves the data recoverable from a backup for an unbounded period is not a deletion.

Deletion is available at any time and does not require a request to anyone, since I operate the systems directly. In practice it takes three forms:

• Disconnecting an institution. Unlinking a financial institution removes its stored access token and the associated account and transaction records from the live database. The connection at the aggregation provider is revoked at the same time, so no further data is retrieved.
• Deleting an account. Removing an application account removes the records associated with it from the live database.
• Decommissioning a service. Retiring an application removes its database and volumes from the host, subject to the backup expiry in section 4.

Deletion from the live system is immediate. Deletion from the backup set is not instantaneous by design, because a backup that can be edited retroactively provides no recovery guarantee. Instead, deleted data ages out on the fixed schedule below.

Backups are encrypted with an independent passphrase and stored offsite. Retention is enforced automatically on every run rather than by manual pruning, so the horizon cannot silently extend.

The practical effect is that data deleted from the live system stops being recoverable from any copy after roughly six months, and most recent data ages out considerably sooner. Backup integrity is verified on an automated weekly schedule.

Backups are encrypted at rest, so expiry of a backup archive renders its contents unrecoverable without any additional destruction step. When a host is decommissioned, its volumes are removed and every secret that host could read is rotated, so residual storage cannot yield a usable credential. Encryption keys are destroyed when the data they protect reaches the end of its retention period.

The deployment serves one individual in the United States and processes no third party personal data, so there is no controller to processor relationship and no obligation owed to an external data subject. The applicable obligation runs to the operator, who is also the data subject. Where a third party provider imposes its own retention or deletion requirements on data received through it, those requirements take precedence over this policy and are honored on request.

This policy is reviewed annually, and whenever the backup schedule, hosting arrangement, or set of connected providers changes. It sits under the Information Security Policy.