Retention Policy

Every refresh from an authorized financial or document connector (Plaid, the Monarch sync, etc.) deletes the prior snapshot from that same source as soon as the new one is safely written. The corpus holds exactly one live snapshot per source at any time. Stale snapshots are not archived; they are removed from both the database and object storage.

Documents you upload to your corpus (PDFs, images, CSVs) are kept indefinitely, along with the AI-extracted markdown rendering, until you delete them from the Corpus screen or via account deletion. The original file and the extracted markdown are deleted together.

When you dismiss a brief, it is suppressed from the planner for 90 days. After that, if the underlying issue is still present in your corpus, it may resurface — because a genuinely persistent problem (a recurring fee, an unclaimed benefit) should not be silenced forever by a single dismissal. Briefs you have acted on are remembered indefinitely so the planner never re-proposes work you have already done.

Action threads (the guided conversations where you work through a brief and the recorded outcome) are kept indefinitely. They form your history with the system — the realized impact tally that crowns the feed is grounded entirely in this record. You can delete an individual thread, or all of them via account deletion.

Concerns you raise and the documents you attach to them are kept until you delete the concern (which removes the concern, its attachments, and the briefs the focused swarm produced for it) or close your account.

Every investigation run is recorded in an audit table (id, timestamp, status, brief count, any AI error). The record contains no document content — only metadata. It is kept indefinitely so problems can be diagnosed weeks or months later.

Standard hosting and database logs (IP, route, timestamp) are retained for the duration the upstream providers default to — currently 90 days for Vercel function logs and the Supabase default for Postgres logs. These logs do not contain document content, financial figures, or other personal data extracted from your corpus.

You can request full deletion of your account and every byte of associated data at any time by emailing brennenm@quobo.co. On confirmation, Done removes:

• your auth record (email, passkey credentials);
• every row in every table keyed to your user id (corpus items, briefs, concerns, action threads, investigations, connector links, snapshots);
• every object in object storage owned by your user id (original uploads and rendered markdown);
• cached connector tokens (Plaid access_tokens and equivalents), and revokes them upstream where the provider supports it.

Confirmed deletions are completed within 30 days. Operational logs held by hosting/database providers expire on their own schedule (typically 90 days). If your country's law sets a shorter window, that window applies.

Supabase maintains automated database backups per its standard retention. A deletion request also clears your data from the next backup taken after the deletion completes; older snapshot backups roll off on the provider's schedule and are not user-restored once a deletion request has been processed.

This policy is reviewed whenever the data model materially changes. The current revision is dated at the top of the page; the change history of the source repository tracks the full lineage.

See also: the Privacy Policy for what is collected and why, and the SECURITY.md file for the full security posture.

brennenm@quobo.co