How long we keep things
This page is the detail behind "How long we keep it" in our privacy policy (§7): the records that outlive a family's account, what a deletion does not reach, and how long each lasts where we set a period. A reference such as §2 is to a section of that policy.
Records that outlive your account
Three kinds of record outlive a family's account, each kept under an identifier that no longer leads to your family:
the record that a deletion was asked for and carried out — when, how it was asked for, and how many entries each place held — and the record of each copy of your data we prepared, with its counts, kept to show each request was honoured; neither holds any content;
the record of each closure scheduled for the account — how and when it was asked for, the day it was scheduled for, whether and why it was cancelled, and when it was carried out (a cancelled closure also keeps the code and time of the last attempt that failed);
the invitation record, reduced to a one-way hash of your email address (a hash that someone who already holds the address could match, so the record is not anonymous), your player's class and program, who on our team made it and its dates; it is deleted 12 months after your account is deleted, or at most 14 days after that.
What a deletion does not reach
Our hosting and database providers' logs, and our database's daily backups, expire on their own schedules, no longer than 90 days; the exact periods are at /privacy/providers. A deleted record can remain in a backup until that backup expires.
Prompts at our AI model provider are deleted by the provider within 30 days, except content it flags as violating its usage policy, which it may keep for up to two years.
A message we delete from our own email is removed from our email provider's systems within 180 days after we delete it (the provider is named at /privacy/providers).
Shared catalog entries your family proposed or that your mail produced stay in the catalog and no longer name or point to your family.
Mail held for routing that was never filed to your family is removed by its 7-day expiry rather than at once.
Our record of the actions our own team takes with our admin tools, and of any refused attempt to use them — who acted, which action it was, which account or record it concerned, and how it ended — is kept with no name and no content, under identifiers, so we can show what was done to an account and by whom.
A deleted message and a school's summary
A school's conversation summary written while a message was there can still reflect it until the summary is next rewritten: on the next message we file for that school (if your family's daily summary limit was reached, or that rewrite failed, our weekly refresh picks it up), or by our weekly refresh, which rewrites the summary of a school on your list more than 30 days old. A refresh that runs out of time, or fails, leaves that summary for the following week, so we cannot promise a date; and a school you have benched is not refreshed, so its summary can keep reflecting the message. A message that a campaign recorded as sent cannot be deleted on its own while that campaign exists, and goes with your account.
Usage counts
A record of each run counted against our usage limits — the feature and the time — is kept with your account; entries older than 30 days are removed the next time your family uses that feature, and all are deleted with the account. The counts of AI processing (§7) are kept per use for 13 months and then as monthly totals for each feature and AI model; counts for research on a school are recorded against that school in our shared catalog, with nothing that links them to your family, and stay; and our usage records for the service as a whole name no family and are kept for as long as they are useful to us.
Other short-lived records
Our hosting provider discards the public-page visit hash after 24 hours. The one-way hash of the network address the demo counts reads against, with the time of each read, is deleted about a day later, the next time the demo is used. The record of a Gmail disconnect that Google did not confirm (one family only, §2) is kept with the account, deleted with it, and removed for good when the Gmail connection is retired.