Plan AI — Data Retention & Deletion Policy
Effective date: `TO BE SUPPLIED: effective date
DRAFT — this is a PROPOSED policy, not a description of current behaviour. No automatic deletion exists in the app today: there is no Firestore TTL policy, no scheduled cleanup function, and no deletion-on-inactivity job. Everything written to the database persists until removed by hand. See COMPLIANCE-GAPS.md §6. Publishing this document before the schedule below is enforced would be a misrepresentation. Implement first, then publish.1. Principle
We keep personal data only as long as it serves the purpose it was collected for, then delete it. Because our users are children, we err toward shorter periods.
2. Retention schedule (proposed)
| Data | Where | Proposed retention | Trigger |
|---|---|---|---|
Account record (users/{uid}) | Firestore | Life of the account, then 30 days | Account deletion |
| Tasks | Firestore + device | Life of the account, then 30 days | Account deletion |
| Routines | Firestore + device | Life of the account, then 30 days | Account deletion |
| Goals | Firestore (on the user record) | Life of the account, then 30 days | Account deletion |
| Planning-style profile | Firestore (on the user record) | Life of the account, then 30 days | Account deletion, or user-initiated reset |
| Uploaded photo | Not stored | n/a — processed in the request and discarded | n/a |
| Tasks extracted from a photo | Firestore + device | Same as any other task | Account deletion |
| Reward points, prize list, spin history | Device only | Until the app's data is cleared or uninstalled | Uninstall or local wipe |
| Parent PIN | Device only | Until changed or the app's data is cleared | Local wipe |
| Weekly plan templates | Device only (localStorage) | Until cleared | Local wipe |
| Language preference | Device only (localStorage) | Until changed | Local wipe |
| Cached subscription tier | Device only (localStorage) | Until changed by the server | Sign-out or local wipe |
| Pending offline sync queue | Device only | Until the change syncs, then deleted | Successful sync |
| Payment records | Stripe / iyzico, and our billing records | As required by Turkish tax and commercial law — 10 years | Statutory |
| Consent record (once built) | Firestore | Life of the account + 3 years after deletion, as evidence of consent | Statutory limitation |
| Error reports (only if Sentry is enabled) | Sentry | 90 days | Automatic |
| Authentication logs | Firebase | Per Google's retention for the service | Automatic |
The 30-day window after account deletion is a safety margin against accidental or malicious deletion. During it the data is inaccessible to the app and is deleted permanently at the end. It can be shortened on request.
3. Deletion on request
A user, or the responsible adult for a child, may request deletion at `TO BE SUPPLIED: privacy contact email address`. We verify the requester's authority, then delete within 30 days, and confirm in writing.
We keep only what the law requires us to keep — principally payment and tax records, and the consent record as evidence that consent was properly obtained.
4. Deletion on inactivity (proposed)
Because the users are children who may simply stop using the app:
- After 24 months of no sign-in, we email the account holder a warning.
- If there is no sign-in within 30 days of that warning, the account and its
data are deleted.
[NOT YET IMPLEMENTED]
5. What must be built
Required both by this policy and, independently, by both app stores. Apple guideline 5.1.1(v) requires in-app account deletion; Google Play requires an in-app path and a web-accessible deletion request URL.
- [ ] In-app account deletion that removes the Firebase Auth user, the
users/{uid} document, and all of that user's tasks and routines documents. Nothing today deletes any of these. handleMasterWipe in App.tsx clears local task data only.
- [ ] A web deletion-request URL, linked from the store listing.
- [ ] A soft-delete marker plus a scheduled Cloud Function to enforce the
30-day window.
- [ ] A Firestore TTL policy or cleanup job for anything with a fixed period.
- [ ] An inactivity job for §4.
- [ ] A data export (§6) — currently absent.
lib/exportUtils.tsproduces a
PDF of the visible timeline, which is a convenience feature and must not be offered as a data-portability export.
6. Export
On request we provide a machine-readable copy of the account record, tasks, routines, goals, and planning-style profile.
[NOT YET IMPLEMENTED] — see above.
7. Data stored only on the device
A large part of the app's data never reaches our servers at all: the whole reward system, saved weekly templates, the language preference, and the parent PIN.
This means:
- We cannot delete it for you, because we never have it.
- Uninstalling the app, or clearing its storage, removes it.
- It is not included in a data export we produce, because we have no copy.
- If the device is shared or resold, that data goes with the device.
8. Backups
Google Cloud maintains its own backups of Firestore. Deleted data may persist in those backups for a period set by Google's own retention, after which it expires. We do not restore individual records from backup to defeat a deletion request.