> ## Documentation Index > Fetch the complete documentation index at: https://recontrol.money/docs/llms.txt > Use this file to discover all available pages before exploring further. # Data Retention and Disposal Policy > How long Recontrol keeps personal data, and how it is securely and permanently disposed of. **Effective Date:** 19 October 2026 **Last Updated:** 19 October 2026 **Version:** 1.3 **Review cycle:** Annually, or upon any significant change to systems or law > [!NOTE] > > **Version 1.3 changes:** corrections to match the Service as it now works. Disconnecting a source keeps what was already imported; plans, alerts, feedback and notifications are listed; the AI Chat entry no longer refers to a fixed snapshot; the web application's session and browser storage are covered (Sections 4, 5.1 and 5.5). > > **Version 1.2 changes:** the database location changed to **AWS us-east-1 (Northern Virginia, United States)**; retention entries were added for **AI Chat questions**, **subscription records**, and **crash reports**; and the account-deletion cascade (Section 5.1) was restated to reflect that shared Spaces are no longer deleted with a departing member. *** ## 1. Purpose This Data Retention and Disposal Policy sets out how Recontrol retains, archives, and disposes of personal data and other information. Its purpose is to ensure that we: * Keep personal data only for as long as necessary for the purposes for which it was collected (the **storage-limitation** principle), * Dispose of data securely and irreversibly when it is no longer required, and * Meet our obligations under the **Digital Personal Data Protection Act, 2023** (the "DPDP Act") and the **Digital Personal Data Protection Rules, 2025**, the **Information Technology Act, 2000** and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the "SPDI Rules"), and recognised practice including **ISO/IEC 27001:2022** and **NIST SP 800-88** (media sanitization). This policy supports our [Privacy Policy](https://recontrol.money/docs/legal/privacy.md) and works alongside our [Information Security Policy](https://recontrol.money/docs/legal/security.md) and [Access Controls Policy](https://recontrol.money/docs/legal/access.md). *** ## 2. Scope This policy applies to all personal data and operational data Recontrol processes, in all systems we control, including: * The application database (PostgreSQL, hosted via Nhost on AWS us-east-1, Northern Virginia, United States), * The application/API server (hosted on Railway in the United States), which processes data in transit but stores none, * Authentication and session data, * Encrypted access tokens for third-party integrations (Plaid, Zerodha), * Device push tokens, * AI Chat question records, * Subscription entitlement records and usage counters, * Server-side logs and operational telemetry, and * Support communications. It covers all environments (production and non-production) and all personnel with access to those systems. *** ## 3. Guiding principles 1. **Storage limitation.** We retain personal data only for as long as it is needed for a clear purpose, or as required by law. 2. **Data minimisation.** We do not collect or retain data we do not need. The App's only analytics tool (PostHog) collects pseudonymous usage events and stripped crash reports that exclude all financial data, and it can be turned off in Settings. We use no advertising or cross-app tracking. AI Chat stores the question but never the answer or the figures that produced it, and no conversation history is kept server-side. 3. **Purpose limitation.** Data is retained only for the purposes described in the [Privacy Policy](https://recontrol.money/docs/legal/privacy.md). 4. **Secure disposal.** When data is no longer required, it is disposed of so that it cannot be reconstructed. 5. **No unnecessary backups.** We do not maintain secondary or offsite backup copies of user data. There is therefore no backup from which deleted data could be restored. 6. **User control.** Users can delete their account and data, and disconnect integrations, at any time. *** ## 4. Retention schedule | Data category | Examples | Retention period | Basis | | - | - | - | - | | **Account & profile** | Email, display name, phone number, and a password hash only for an account created with a password in an earlier version | While the account is active; deleted on account deletion | Necessary to provide the Service | | **Financial data** | Accounts, transactions, balances, budgets, goals, watchlists and their alerts | While the account is active; deleted on account deletion | Core functionality | | **Imported data** | Bank accounts and transactions, and holdings, card and loan terms and recurring payments where reported (Plaid); investment holdings (Zerodha) | Until the user deletes it or deletes the account. Disconnecting the source stops further imports and keeps what was already imported | Consent / feature provision | | **Integration access tokens** | Encrypted Plaid / Zerodha tokens | Until disconnect or account deletion; Zerodha tokens also expire daily | Necessary to maintain the integration | | **Authentication tokens** | JWT access tokens, refresh tokens | Short-lived; expire automatically; refresh tokens invalidated on logout / deletion | Session security | | **Session data** | Session IDs, login timestamps; in the web application, the sealed session cookie | Duration of the session; cleared on logout. The web application's session cookie expires within a day of sign-in | Session security | | **Device push tokens** | Expo push token, device name, platform | Until you disable notifications, sign out, or delete your account | Delivering notifications you enable | | **Country / region** | Two-letter country code from your device at sign-up | While the account is active; deleted on account deletion | Regional privacy rights and defaults | | **AI Chat questions** | The text of a question asked in AI Chat, and the outcome of the exchange. **Answers, and the data sent to the model with them, are never stored** | While the account is active; deleted on account deletion, or earlier on request | Understanding which questions users ask, to inform product development | | **Feedback** | Messages sent through Send Feedback, with their type, the Space they were sent from and any diagnostics the person included | While the account is active; deleted on account deletion | Fixing defects and improving the Service | | **Notifications** | Notifications sent to the person, and whether they were read | While the account is active; deleted on account deletion | Providing the in-App notifications inbox | | **Subscription records** | Entitlement expiry, an opaque provider customer identifier, monthly usage counters, Space sponsorships. **No payment instrument** | While the account is active; deleted on account deletion. Usage counters reset on the 1st of each calendar month | Providing paid features and enforcing fair-use limits | | **Product-analytics and crash-report events** | Pseudonymous usage events and stripped crash reports (PostHog); no financial data | Held by PostHog under our analytics retention settings; collection stops on opt-out (in the web application in the EEA and the UK, collection starts only on opt-in) | Product improvement and defect diagnosis | | **Server-side telemetry** | Traces, metrics, timings, route names, error codes and opaque identifiers (OpenTelemetry → Grafana Cloud), filtered by a source-side allowlist | Up to **12 months**, then deleted or anonymised; not linked to user profiles | Infrastructure monitoring, security, debugging | | **Support communications** | Emails to support | Up to **24 months** after last contact | Customer support, dispute handling | | **Legal-hold data** | Records subject to a legal obligation or proceeding | Only for as long as legally required, then disposed of | Legal obligation (see Section 7) | We periodically review whether retained data is still necessary and dispose of data that is not. > **Voluntary benchmark.** Although Recontrol does not meet the user thresholds that make the DPDP Rules, 2025 fixed three-year erasure rule mandatory for it, we apply the spirit of that rule: where an account becomes dormant and the retention purpose has lapsed, we may notify the user and erase associated personal data. *** ## 5. Disposal methods We use the disposal method appropriate to the medium and the sensitivity of the data, following the **Clear / Purge / Destroy** framework of NIST SP 800-88. ### 5.1 Logical deletion (database) User-initiated and account deletions remove records from the production PostgreSQL database. Deletion runs in a defined order rather than relying on database cascades alone: 1. **Connected integrations are revoked first**, at the provider, so no live token survives the deletion of the record that pointed at it (Section 5.2). 2. **The user is withdrawn from every Space**, under the same rules a deliberate departure follows. A Space in which they are the **sole member** is deleted with them, along with its accounts, transactions, balances, goals, roles, and connection records. A Space with **other members is retained** — those records are the Space's and other members' personal data, not solely the departing user's; transactions the departing user recorded there remain, shown as recorded by a "Former member" — and, where the departing user was its only administrator, the longest-standing remaining member is granted an administrator role so the Space cannot be left unmanageable. **Erasure is never blocked by this step.** 3. **The authentication record is then deleted**, cascading the user's own remaining rows via `ON DELETE CASCADE` — profile, memberships, role assignments, AI Chat question records, feedback, notifications, entitlement and usage records, sponsorships, device push tokens, and refresh tokens (ending all sessions). Because we keep **no backups**, a deleted record has no secondary copy to restore from. (Pending invitations are addressed to an email address or phone number rather than to a user account, so they are not part of a deleted user's record.) A subscription held with Apple or Google is **not** a record we control and is therefore not deleted or cancelled by this process — see [Privacy Policy Section 4B.3](https://recontrol.money/docs/legal/privacy.md#4b-subscriptions-and-payments). ### 5.2 Cryptographic erasure (crypto-shredding) of integration tokens Access tokens for connected banks and brokers are stored **encrypted with AES-256-GCM**. When a user disconnects an integration or deletes their account, we: 1. **Revoke** the token with the provider (Plaid `item/remove`, Zerodha session revocation), and 2. **Delete** the encrypted token record from our database. Because the stored value is only meaningful when decrypted with a key we control, deleting the ciphertext (and the absence of any backup) renders it cryptographically unrecoverable. ### 5.3 Physical media sanitization (cloud) Recontrol operates entirely on managed cloud infrastructure (AWS, via Nhost). We do not own or physically control storage media. Sanitization and decommissioning of physical media is performed by AWS under its own media-disposal programme, which is independently certified (including to ISO/IEC 27001 and aligned with NIST SP 800-88). We rely on these provider controls for physical destruction. **Decommissioning after the 2026 region migration.** When the database moved from AWS ap-south-1 to AWS us-east-1 on 29 July 2026, the source project was retained briefly as a rollback path and is decommissioned once the new environment is confirmed stable, after which its storage is destroyed under the AWS programme above. Any local copy taken for the transfer is deleted once the migration is verified. ### 5.4 Logs and telemetry Operational logs and telemetry are configured to age out automatically within the retention window in Section 4. Sensitive fields are removed **before export**, by a deny-by-default allowlist applied at the source, so sensitive personal data does not reach the telemetry pipeline in the first place rather than being deleted from it afterwards (see the [Information Security Policy](https://recontrol.money/docs/legal/security.md)). ### 5.5 Local data on user devices Authentication tokens and session state stored on a user's device (iOS Keychain / Android Keystore via Expo Secure Store, and AsyncStorage) are cleared on logout or app uninstall. This data never includes plaintext integration tokens. In the web application, the session cookie is cleared on sign-out and expires within a day of sign-in, and the access token is held in memory only. Preferences kept in browser storage (such as Hide amounts or the analytics choice) stay in that browser until the person clears them. *** ## 6. Account deletion Users may delete their account and all associated personal data at any time: * **In-app** (Settings → Delete Account) — processed **immediately**, and * **By email** to [support@recontrol.money](mailto:support@recontrol.money) — processed within **30 days**. On deletion, the sequence in Section 5.1 and the crypto-shredding in Section 5.2 apply. Deletion is **permanent and irreversible**, is **never blocked** by a shared Space, and does not require the user to transfer or delete a Space first. See [Delete your data](https://recontrol.money/docs/data/delete.md) for the user-facing process. Users may also request erasure of a narrower category without deleting their account — for example, the AI Chat questions recorded against them. *** ## 7. Legal holds and exceptions We may retain specific data beyond the periods above **only** where required to: * Comply with a legal obligation, court order, or lawful request from a competent authority, or * Establish, exercise, or defend a legal claim. Where a legal hold applies, the affected data is retained only for as long as the obligation persists and is then disposed of under Section 5. We do not retain data for business purposes after an account is deleted. *** ## 8. Verification and records * **Verification.** Disposal is verified by confirming the absence of the record (logical deletion) and successful provider-side revocation (integrations). Because no backups exist, no separate backup-purge verification is needed. * **Records of disposal.** Where we action a manual (email) deletion or a legal-hold disposal, we keep a minimal, non-personal record that the disposal occurred and when, for accountability — without retaining the disposed data itself. * **User confirmation.** Users may request written confirmation that their data has been deleted. *** ## 9. Roles and responsibilities | Role | Responsibility | | - | - | | **Data Fiduciary** (Mrinal Wahal, sole proprietor) | Owns this policy; approves retention periods; authorises legal holds and exceptions | | **Grievance Officer** ([support@recontrol.money](mailto:support@recontrol.money)) | Receives and actions data-deletion and rights requests | | **Any person with system access** | Must follow this policy and must not retain or copy personal data outside approved systems | *** ## 10. Review This policy is reviewed at least **annually**, and whenever there is a significant change to our systems, data flows, or applicable law (including changes to the DPDP Act or its Rules). Material changes are reflected in the "Last Updated" date and version above. *** ## 11. Contact Questions about this policy, or requests to delete data, may be directed to: * **Grievance Officer:** Mrinal Wahal * **Email:** [support@recontrol.money](mailto:support@recontrol.money) * **Mailing Address:** 2005, Yucca, Paramount Symphony, Crossing Republik, Ghaziabad, Uttar Pradesh, India 201016 This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.