Church Abandoned retention policy

Version CA-RETENTION-NOTICE-2026-10-17-v3

The consent-retention rules below remain CA-CONSENT-RETENTION-2026-10-16-v1; this notice adds the deployed moderation-record disclosure and the retry-queue rules for automatic chat-error reporting in the upcoming, not-yet-released mobile build.

This notice also covers optional adults-only safety-rule improvement when the compatible app choice, Settings control and service safeguards are available. It does not enroll anyone or authorize reuse without explicit opt-in.

New child activation is currently disabled.

An unlinked request expires 24 hours after its creation. A parent-linked unfinished request, including approval not used to create an account, expires 30 days after its first linking. QR replacement, recovery and activity do not extend those deadlines. Expired requests lose access and enter cleanup.

While the under-13 account relies on consent, the church keeps the exact notice/signature and necessary verification evidence. Withdrawal, account deletion or the actual 13th birthday closes that consent purpose. Only minimal consent/verification evidence is then kept, for up to 90 days from the original closure, to reconcile verification and closure requests; valid deletion or loss of necessity can remove it earlier. This does not permit retaining the child's profile, messages or files for those 90 days.

Account/family/security records remain only for their ongoing account purpose and applicable deletion process. The separate minimal parent-management link does not extend signed-consent retention. Active chat content/files have a 90-day-from-creation rule; still-unexpired content in an archived room can instead remain for 90 days from archival. Abuse-report evidence has its separate 90-day-from-report schedule. Restricted automated-moderation incidents follow their separate 90-day incident schedule. After incident text and details expire, minimal room/restriction associations can remain so an authorized administrator can review and lift an existing restriction; this does not extend retention of the expired text. Moderation debugging metadata has a 30-day availability cutoff and asynchronous cleanup; it contains references, decisions and diagnostic measurements, not copied message/context bodies. Viewing source text remains subject to its original access, retention and edit checks. Inference prefix state can remain in memory; no immediate memory-erasure promise is made. Model requests are not written to inference-service disk or application logs. Manual and automatic problem reports have a 30-day availability cutoff and scheduled cleanup. Manually saved pending report attempts expire on access after seven days. In the upcoming mobile update, automatic chat-error reports use a separate secure on-device retry queue with a 24-hour delivery window. Delivery is attempted immediately and retried after a later successful chat request; expired queued reports are discarded when the queue is next checked, rather than guaranteed to be physically erased at exactly 24 hours. The full privacy notice describes shared-record and provider metadata limits.

Access ends at the applicable cutoff; physical cleanup runs in batches and can lag during outages or backlogs. Database prior versions have a one-hour window. Inventoried cloud-log buckets use 30-day and 400-day schedules; these are separate provider/administrative records, not an extension of consent-evidence retention. We cannot erase copies already saved by recipients. No universal immediate-erasure guarantee is made.

Optional improvement does not restart a message or incident's retention period. Source-linked improvement records expire no later than 30 days after first selection and earlier if the source expires, is deleted, permission is withdrawn, or eligibility ends. Candidate and evaluation records have a maximum 30-day period from creation, shortened by applicable source deadlines. We stop access at the cutoff and remove records through scheduled cleanup. We do not keep copied message text, private review details or message embeddings for improvement.

We keep your current optional-use preference and the version and time of that choice while needed to honor it for your account. Turning the feature off keeps it off; it does not extend retention or use of messages. Account deletion removes the preference through the account-deletion process. Temporary withdrawal markers expire after 30 days; their expiry does not change your choice or permit reuse. Approved general rules and minimal administrator approval records may remain while active or needed for a designated rollback version; we remove them within 30 days after that need ends. Retained aggregate results must not identify or single out members and follow the corresponding candidate or active-rule schedule. We do not promise immediate physical erasure from every system.