Our approach
We aim to keep personal information only while needed for the purpose for which it was collected, a request you have made, a documented dispute or a legal obligation. There is currently no automatic age-based purge of community submissions. We will not describe a proposed timer as an implemented guarantee.
Records and removal criteria
| Record | Current retention and removal |
|---|---|
| Device preferences, saves and explanation votes | Remain in local app/browser storage until cleared or replaced. Account deletion does not remotely erase an offline device. |
| Reading progress | A bounded recent history is stored locally (up to 180 records), plus the current daily edition. This is a record limit, not a 180-day expiry. |
| Unsent drafts | Remain locally until successful submission or device/browser storage is cleared. Sign-out does not itself erase drafts. |
| Authentication sessions | Persist in local browser/device storage until sign-out, expiry or clearing. A service-side account deletion also needs session handling. |
| Account/profile and follows | Needed while the account is active. A verified deletion request starts removal of account-linked community records, subject to documented lawful exceptions. |
| Pending submissions | Held while awaiting source verification and a human decision. There is no implemented automatic expiry; unresolved records need manual review for continued necessity. |
| Approved contributions | Remain linked to the contributor while the public contribution is available. Removal must cover the public attribution, personal interpretation and related private submission records. |
| Rejected submissions and review notes | Retained only as needed to explain or revisit the decision, prevent abuse or handle a dispute. A reviewer must decide when that purpose ends; no automatic deletion period is currently configured. |
| Downloaded queue batches and Qwen reviews | Local working copies must be included in review/removal. Deleting the server row does not automatically remove a downloaded JSON file or computer backup. |
| Privacy requests | Kept privately to process the request and, where needed, demonstrate how it was handled. Remove unnecessary message content after resolution; document any remaining compliance record. |
| Spotify tokens | Kept in native secure storage or the web tab session until local disconnect/expiry. Revoke access separately in Spotify when needed. |
| Provider logs and backups | Follow the actual configured provider plan, backup/log expiry and applicable obligations. We have not verified a single end-to-end expiry period and do not promise immediate removal from all backups. |
Handling a deletion request
A request is first recorded as pending. An authorised person verifies account ownership and scope, handles any lawful retention exception, removes the account-linked active records and local review copies, and records the outcome. Completing a request must include the authentication account and its sessions, not just hiding a profile.
Where a canonical lyric or song record is independent of your personal contribution and other contributors still use it, that shared catalogue record may remain. Your account attribution and personal interpretation should be removed as applicable. Copies other people already made of public content or shared posts may be outside our control.
Backups and exceptional retention
Data in a backup may remain until that backup expires. Backups are for recovery, not continued active use of deleted profiles. If a backup is restored, previously completed deletion requests must be reapplied. Device and reviewer-computer backups have to be considered separately from Supabase backups.
An exception must identify the specific information, reason, access restriction and next review point. A vague possibility of future use is not a reason to keep everything indefinitely.