Skip to main content
Effective Date: 29 July 2026 Last Updated: 29 July 2026 Version: 1.2 Review cycle: Annually, or upon any significant change to systems or law
Version 1.2 changes: the database location changed to AWS us-east-1 (Northern Virginia, United States); retention entries were added for AI Chat questions, subscription records, and crash reports; and the account-deletion cascade (Section 5.1) was restated to reflect that shared Spaces are no longer deleted with a departing member.

​
1. Purpose

This Data Retention and Disposal Policy sets out how Recontrol retains, archives, and disposes of personal data and other information. Its purpose is to ensure that we:
  • Keep personal data only for as long as necessary for the purposes for which it was collected (the storage-limitation principle),
  • Dispose of data securely and irreversibly when it is no longer required, and
  • Meet our obligations under the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (the “SPDI Rules”), and recognised practice including ISO/IEC 27001:2022 and NIST SP 800-88 (media sanitization).
This policy supports our Privacy Policy and works alongside our Information Security Policy and Access Controls Policy.

​
2. Scope

This policy applies to all personal data and operational data Recontrol processes, in all systems we control, including:
  • The application database (PostgreSQL, hosted via Nhost on AWS us-east-1, Northern Virginia, United States),
  • The application/API server (hosted on Railway in the United States), which processes data in transit but stores none,
  • Authentication and session data,
  • Encrypted access tokens for third-party integrations (Plaid, Zerodha),
  • Device push tokens,
  • AI Chat question records,
  • Subscription entitlement records and usage counters,
  • Server-side logs and operational telemetry, and
  • Support communications.
It covers all environments (production and non-production) and all personnel with access to those systems.

​
3. Guiding principles

  1. Storage limitation. We retain personal data only for as long as it is needed for a clear purpose, or as required by law.
  2. Data minimisation. We do not collect or retain data we do not need. The App’s only analytics tool (PostHog) collects pseudonymous usage events and stripped crash reports that exclude all financial data, and it can be turned off in Settings. We use no advertising or cross-app tracking. AI Chat stores the question but never the answer or the figures that produced it, and no conversation history is kept server-side.
  3. Purpose limitation. Data is retained only for the purposes described in the Privacy Policy.
  4. Secure disposal. When data is no longer required, it is disposed of so that it cannot be reconstructed.
  5. No unnecessary backups. We do not maintain secondary or offsite backup copies of user data. There is therefore no backup from which deleted data could be restored.
  6. User control. Users can delete their account and data, and disconnect integrations, at any time.

​
4. Retention schedule

We periodically review whether retained data is still necessary and dispose of data that is not.
Voluntary benchmark. Although Recontrol does not meet the user thresholds that make the DPDP Rules, 2025 fixed three-year erasure rule mandatory for it, we apply the spirit of that rule: where an account becomes dormant and the retention purpose has lapsed, we may notify the user and erase associated personal data.

​
5. Disposal methods

We use the disposal method appropriate to the medium and the sensitivity of the data, following the Clear / Purge / Destroy framework of NIST SP 800-88.

​
5.1 Logical deletion (database)

User-initiated and account deletions remove records from the production PostgreSQL database. Deletion runs in a defined order rather than relying on database cascades alone:
  1. Connected integrations are revoked first, at the provider, so no live token survives the deletion of the record that pointed at it (Section 5.2).
  2. The user is withdrawn from every Space, under the same rules a deliberate departure follows. A Space in which they are the sole member is deleted with them, along with its accounts, transactions, balances, goals, roles, and connection records. A Space with other members is retained — those records are the Space’s and other members’ personal data, not solely the departing user’s — and, where the departing user was its only administrator, the longest-standing remaining member is granted an administrator role so the Space cannot be left unmanageable. Erasure is never blocked by this step.
  3. The authentication record is then deleted, cascading the user’s own remaining rows via ON DELETE CASCADE — profile, memberships, role assignments, AI Chat question records, entitlement and usage records, sponsorships, device push tokens, and refresh tokens (ending all sessions).
Because we keep no backups, a deleted record has no secondary copy to restore from. (Pending invitations are addressed to an email address or phone number rather than to a user account, so they are not part of a deleted user’s record.) A subscription held with Apple or Google is not a record we control and is therefore not deleted or cancelled by this process — see Privacy Policy Section 4B.3.

​
5.2 Cryptographic erasure (crypto-shredding) of integration tokens

Access tokens for connected banks and brokers are stored encrypted with AES-256-GCM. When a user disconnects an integration or deletes their account, we:
  1. Revoke the token with the provider (Plaid item/remove, Zerodha session revocation), and
  2. Delete the encrypted token record from our database.
Because the stored value is only meaningful when decrypted with a key we control, deleting the ciphertext (and the absence of any backup) renders it cryptographically unrecoverable.

​
5.3 Physical media sanitization (cloud)

Recontrol operates entirely on managed cloud infrastructure (AWS, via Nhost). We do not own or physically control storage media. Sanitization and decommissioning of physical media is performed by AWS under its own media-disposal programme, which is independently certified (including to ISO/IEC 27001 and aligned with NIST SP 800-88). We rely on these provider controls for physical destruction. Decommissioning after the 2026 region migration. When the database moved from AWS ap-south-1 to AWS us-east-1 on 29 July 2026, the source project was retained briefly as a rollback path and is decommissioned once the new environment is confirmed stable, after which its storage is destroyed under the AWS programme above. Any local copy taken for the transfer is deleted once the migration is verified.

​
5.4 Logs and telemetry

Operational logs and telemetry are configured to age out automatically within the retention window in Section 4. Sensitive fields are removed before export, by a deny-by-default allowlist applied at the source, so sensitive personal data does not reach the telemetry pipeline in the first place rather than being deleted from it afterwards (see the Information Security Policy).

​
5.5 Local data on user devices

Authentication tokens and session state stored on a user’s device (iOS Keychain / Android Keystore via Expo Secure Store, and AsyncStorage) are cleared on logout or app uninstall. This data never includes plaintext integration tokens.

​
6. Account deletion

Users may delete their account and all associated personal data at any time:
  • In-app (Settings → Delete Account) — processed immediately, and
  • By email to support@recontrol.money — processed within 30 days.
On deletion, the sequence in Section 5.1 and the crypto-shredding in Section 5.2 apply. Deletion is permanent and irreversible, is never blocked by a shared Space, and does not require the user to transfer or delete a Space first. See Delete your data for the user-facing process. Users may also request erasure of a narrower category without deleting their account — for example, the AI Chat questions recorded against them.
We may retain specific data beyond the periods above only where required to:
  • Comply with a legal obligation, court order, or lawful request from a competent authority, or
  • Establish, exercise, or defend a legal claim.
Where a legal hold applies, the affected data is retained only for as long as the obligation persists and is then disposed of under Section 5. We do not retain data for business purposes after an account is deleted.

​
8. Verification and records

  • Verification. Disposal is verified by confirming the absence of the record (logical deletion) and successful provider-side revocation (integrations). Because no backups exist, no separate backup-purge verification is needed.
  • Records of disposal. Where we action a manual (email) deletion or a legal-hold disposal, we keep a minimal, non-personal record that the disposal occurred and when, for accountability — without retaining the disposed data itself.
  • User confirmation. Users may request written confirmation that their data has been deleted.

​
9. Roles and responsibilities

​
10. Review

This policy is reviewed at least annually, and whenever there is a significant change to our systems, data flows, or applicable law (including changes to the DPDP Act or its Rules). Material changes are reflected in the “Last Updated” date and version above.

​
11. Contact

Questions about this policy, or requests to delete data, may be directed to:
  • Grievance Officer: Mrinal Wahal
  • Email: support@recontrol.money
  • Mailing Address: 2005, Yucca, Paramount Symphony, Crossing Republik, Ghaziabad, Uttar Pradesh, India 201016