What we keep, for how long, what deletion actually does — and what is not yet automated.
Every period below is enforced by a job that runs daily, not a promise — with one exception, named in its own row, because a list that hides its gap is worse than a shorter list. The job records every run — which rule, how many rows it matched, how many it deleted — so that "we delete this after thirteen months" is a thing we can be held to rather than a thing we say.
Automatic deletion started on 14 September 2026.
| What | Kept for | Why that long |
|---|---|---|
| Your questions and reports | Until you delete them | They are yours and they are the product. No timer deletes your work. |
| Consumer photos and PDFs | Not stored at all | They are sent to produce your report and never written to our servers. |
| Practice source documents | Until the report or the account is deleted | Deleted with the report they belong to, and with the account. There is no timed sweep for these: they are the one item on this page that the daily job does not reach, because they are files in a bucket rather than rows in a table. We would rather name that than print a period nothing enforces. |
| Product analytics | 13 months, then only as daily totals | Long enough to see a year-over-year shape. The raw events go; the counts stay. |
| Rate-limit and abuse counters | 24 hours | The windows are 60 seconds. A day is already generous. |
| API usage records | 90 days | Enough to answer a billing question. No request bodies are stored at any point. |
| Model cost and outage ledger | 24 months | A financial record. Contains no personal data — token counts, latency, model names. |
| Billing records | 7 years | Tax law, and not ours to shorten. |
| Waitlist | 24 months, or until you ask | If we have not launched to you in two years, we should not still have your address. |
| Deleted accounts | Immediately | Not on a timer — the moment you press the button. |
These periods are ours. They live in a single configuration table, so changing one is a one-line change we can make the day you tell us to, without a code release.
Deleting your account (Account → Delete account) removes the account row itself, not a flag on it. It deletes, in one transaction: your reports, and with them their edit history, engagement events and refinement requests; your Practice workspaces and the client records in them; your analytics events; your usage counters; your profile; and your authentication record. The app shows you the counts of what was removed.
Deleting a single report removes that report and everything attached to it.
Asking us works too, for anything the app does not expose: privacy@bridgeshorelabs.com, answered within 30 days.
A job runs once a day inside the database. Before it deletes any analytics, it writes that day's funnel totals to a summary table — so the thirteen-month history survives the rows it was computed from, and deleting the raw events does not quietly destroy the record.
Every rule writes an audit row on every run, whether it deleted anything or not, and a rule that fails is reported on our health endpoint rather than passing in silence. A deletion job that has quietly stopped working is the failure nobody notices — the data simply stays and this page becomes false — so we monitor for exactly that.
| Category | Where it lives | Retention |
|---|---|---|
| Account | Your email address and the plan you are on. | Until you delete your account, which deletes the record itself rather than hiding it |
| Anonymous device identity | A random code this browser or app made up for itself. Not your name, not your phone. | Until the device record is deleted or migrated into an account on sign-in |
| Questions, answers and reports | What you asked and the report it produced. | Until you delete the report or your account |
| Reports you chose to share by link | A copy of the one report you published, and the passcode or end date you set. | 90 days, enforced daily — or immediately when you stop sharing, which deletes the copy |
| Attachments | Practice only: a document a firm attached to a client's deliverable. | Until the report or the account is deleted |
| Practice client records | A firm's notes about its own client — name, email, and the details it keeps so it does not retype them. | Until the professional deletes the client or the account |
| Usage counters and rate limits | How many questions have been asked, so limits and abuse protection work. No question text. | 24 hours, enforced daily |
| Product analytics | Which steps happened, as counts. Never what you asked. | 13 months, then kept only as daily totals — enforced daily |
| Engagement events | Whether a delivered report was opened, read or replied to. | Cascades when the report is deleted |
| Billing | Who is paying and for what. Card details go to Stripe and never reach us. | Kept while the subscription exists and afterwards for accounting purposes |
| Waitlist | An email address someone left to hear when we open. | 24 months, or until you ask to be removed — enforced daily |
| Operational telemetry | How long the engine took and what it cost. No personal data. | 24 months, enforced daily. No personal data: token counts, latency and model names only |
Daily database backups are taken and retained by our infrastructure provider for seven days; the provider's backups do not include uploaded files, which Askhive copies nightly into a second bucket on the same provider and keeps for thirty days. A deletion is immediate in the live database, and the backup copies containing the deleted data age out of that seven-day window rather than being surgically edited — restoring a backup to remove one row would risk everyone else's data. Point-in-time recovery is not yet enabled, so the worst-case recovery window is 24 hours.
For data a professional holds about their clients, the professional decides retention — they are the controller and we act on their instructions. See §8 of the Data Processing Agreement, which commits us to delete within 30 days of termination on request.
United States (AWS us-east-1, Northern Virginia).