Keep what you need. Delete what you choose.

Your retention choice

Before processing a financial workspace, choose 12 months, 24 months or 7 years of transaction and net-worth snapshot history. The choice is recorded with consent separately for real and Sandbox records. Expiry uses the transaction date or snapshot timestamp. The scheduled worker removes expired history; expired transactions are also rejected on import so a later sync cannot restore them. A shorter retention choice can permanently remove older records on the next cleanup. Export anything you need first.

Current accounts, budgets, recurring bills, debts, creditor reports, assets and goals remain while their workspace is active or until you delete them. Active bank credentials remain only while needed for authorized sync. Default category labels are shared; custom categories belong to their own workspace.

Audit and security records

Financial change-audit payloads expire after 90 days and are erased with their workspace. Minimal security-event records contain the action, owner identifier, workspace and time, not transaction payloads; they expire after 90 days. Revoked consent records and completed deletion receipts expire after 90 days. An active consent record remains while processing is authorized. MFA session proofs expire after 12 hours. The owner identity and approved authenticator remain for access control until the application account is decommissioned through the operator.

Withdrawal and deletion

In Security & privacy, type DELETE LIVE, DELETE SANDBOX or DELETE ALL to request deletion. Access and background sync for the chosen workspace stop immediately. The worker revokes connected Plaid Items and removes their encrypted tokens, cursors, Item references, accounts, imported and manual transactions, financial audit payloads, bills, budgets, debts, collection reports, assets, goals and snapshots. Unused custom categories and financial preferences are reset. Investment research remains separate.

Cleanup starts after the request and is retried by the scheduled worker every 15 minutes. Failed provider revocation stays visibly pending; encrypted credentials are restricted to the revocation worker until the provider confirms removal. The application does not mark deletion complete prematurely. Contact alrazi@alrazibashir.com if the displayed cleanup is stale or a request remains pending.

Backups and restores

Application deletion does not immediately rewrite a managed provider’s internal backups. Their expiry is controlled by the provider and subscribed plan. This project uses Supabase Pro, whose published plan provides access to the last seven days of daily database backups. Point-in-time recovery is currently disabled. This plan window does not independently prove physical erasure of every provider-internal recovery copy.

With the current security schema, a database restart or restore pauses financial access and syncing. Backups that predate that schema must be restored in an isolated environment and have the current security migrations reapplied before any API access is allowed. Before resuming, an administrator must supply the latest deletion manifest kept outside database backups, replay its completed deletions, finish provider revocations and explicitly approve restart. Previous MFA session proofs are then invalidated and workspace consent must be renewed. Never restore a backup without the current external manifest. Completed receipts are downloadable from Security & privacy; the owner must preserve the external copy for the full lifetime of any retained backup. Managed backup expiry and external-copy handling must be verified before claiming complete backup-erasure compliance.

Operational copies

Private responses use no-store caching. rren does not intentionally log passwords, one-time codes, tokens or bank transaction payloads. Managed authentication and infrastructure logs follow the provider’s configured retention; administrative access must remain restricted. Exported files, email copies, screenshots and owner-created backups are separate copies controlled by the owner and must be deleted when no longer needed. This application cannot remotely erase those files or another provider’s legal retention obligations.

Retention, deletion and backup handling are reviewed at least quarterly and whenever providers or collection purposes change. For export, correction or account decommissioning, contact alrazi@alrazibashir.com.