Data Retention Policy

This document describes how long Task Ember retains each category of data stored in our application database (Azure Cosmos DB, UK South region) and the process by which personal data is erased following an account deletion request.

Last updated: April 2026

Container-by-container retention

Cosmos DB's per-item ttl field drives automatic deletion where it is set. Values below are the defaults configured on each container.

Note: containers marked "Deleted when the owning user is deleted" rely on the cascade path in lib/admin/delete-user-core.ts. They do not carry a per-item TTL; they are removed as part of the self-serve or admin delete flow.

Erasure path (self-serve delete)

When a user initiates self-delete from /profile/delete-account:

1. The confirmation form requires the user to re-type their email AND type the literal word DELETE. Both must match exactly.
2. The server action verifies the session matches the user being deleted (no one else can trigger this path).
3. A user-logs entry is written BEFORE deletion runs so the audit trail survives partial failures.
4. deleteUserCore cascades:
   • Workspaces (and schedules / invitations referencing them)
   • Resources (cancels active Stripe subscriptions and adjusts the account balance)
   • Resource bundles and user bundles (unlinked from workspaces, webhooks, and wiki spaces)
   • Workspace templates
   • Credential ownership records (and corresponding Key Vault secrets)
   • Custom app registrations (and their Key Vault secrets)
   • Webhook configs (and their APIM subscriptions)
   • Pending workspace invitations sent by the user
5. The user document itself is deleted from the users container.
6. The user is redirected to /account-deleted.

30-day grace period

For personal data stored in user-scoped containers (per the "Deleted when the owning user is deleted" rows above), the self-serve delete purges synchronously. We treat this as the "30-day" horizon under GDPR because third-party subprocessors (Azure Backup, Sentry) retain incremental backups for up to 30 days before rolling off.

After 30 days, no personal data remains in any system, except for:

• billing-logs (retained for 12 months for legal record-keeping)
• user-logs entries that refer to the user as performedBy or targetUser (kept for the container TTL above for audit-trail integrity)
• processed-stripe-events idempotency records (retained for 180 days; these store Stripe event IDs, not personal data, but may reference the user's Stripe customer ID)

What we cannot delete on request

• Stripe invoices and payment receipts. These live in Stripe and are subject to Stripe's retention. Users should download invoices from their Stripe customer portal before deleting their Task Ember account.
• Third-party monitoring data (Sentry, Azure Monitor). Session replays are masked by default and time out per Sentry's retention; errors are retained per Sentry's plan-level policy.
• Backups held by Azure. Azure Cosmos DB automatic backups are retained for 30 days. Personal data in those backups rolls off naturally.

Exercising your rights

• Export your data: /profile/export-data
• Delete your account: /profile/delete-account
• Questions: privacy@taskember.com