Church Abandoned retention policy

Version CA-CONSENT-RETENTION-2026-10-16-v1

New child activation is currently disabled.

An unlinked request expires 24 hours after its creation. A parent-linked unfinished request, including approval not used to create an account, expires 30 days after its first linking. QR replacement, recovery and activity do not extend those deadlines. Expired requests lose access and enter cleanup.

While the under-13 account relies on consent, the church keeps the exact notice/signature and necessary verification evidence. Withdrawal, account deletion or the actual 13th birthday closes that consent purpose. Only minimal consent/verification evidence is then kept, for up to 90 days from the original closure, to reconcile verification and closure requests; valid deletion or loss of necessity can remove it earlier. This does not permit retaining the child's profile, messages or files for those 90 days.

Account/family/security records remain only for their ongoing account purpose and applicable deletion process. The separate minimal parent-management link does not extend signed-consent retention. Active chat content/files have a 90-day-from-creation rule; still-unexpired content in an archived room can instead remain for 90 days from archival. Abuse-report evidence has its separate 90-day-from-report schedule. Problem reports have a 30-day cutoff. The full privacy notice describes shared-record and provider metadata limits.

Access ends at the applicable cutoff; physical cleanup runs in batches and can lag during outages or backlogs. Database prior versions have a one-hour window. Inventoried cloud-log buckets use 30-day and 400-day schedules; these are separate provider/administrative records, not an extension of consent-evidence retention. We cannot erase copies already saved by recipients. No universal immediate-erasure guarantee is made.