Data Retention Policy

This Data Retention Policy describes what data createtodo retains, for how long, and the processes by which data is deleted or anonymized, in accordance with the GDPR principle of storage limitation (Article 5(1)(e)).

1. Guiding Principles

• Minimization: We only retain personal data for as long as necessary to fulfill the purpose for which it was collected.
• Purpose limitation: Data is not repurposed beyond its original collection purpose without consent.
• Automated enforcement: Retention limits are enforced programmatically, not manually.

2. Retention Schedule

2.1 User Account Data

2.2 Authentication Data

2.3 User-Generated Content

2.4 Presence Data

2.5 Organization and Workspace Data

2.6 Payment and Billing Data

2.7 Email Marketing Data

2.8 Technical and Operational Data

3. Account Deletion Process

When a user deletes their account (or an admin soft-deletes a user):

Immediate actions (Day 0):

1. Account is soft-deleted (deletedAt timestamp set, isActive set to false).
2. All workspace member records are anonymized (display name set to “Former Member”, avatar removed).
3. All active sessions are invalidated and deleted.
4. User’s contact record is removed from the email provider (Loops).

Grace period (14 days):

• The user can sign back in during this period and cancel the deletion.
• On cancellation, the account is restored and member display names are recovered from the user’s profile.

Automated purge (after 14 days):

1. User’s name is replaced with a “Deleted User” placeholder.
2. Email is replaced with an anonymized deleted-<uuid>@deleted.invalid address.
3. Profile image, display name, avatar URL, and phone number are set to null.
4. All passkey credentials are deleted.
5. All OAuth account links are deleted.
6. All remaining sessions are deleted.
7. The user record is permanently hard-deleted from the database.
8. Foreign key cascades set members.userId to null, severing the link between the anonymized member shell and the deleted user.

Admin immediate erase: Administrators can bypass the grace period and immediately erase a user via the admin API, combining both phases in one step.

Content authored by deleted users (todos, comments) is not deleted, but the user’s identity is fully anonymized and attributed to “Former Member”. This preserves workspace integrity for other members.

4. Data Export (Portability)

Users may request an export of their personal data by contacting privacy@createtodo.com. Exports include:

• User profile data
• Todos and comments authored by the user
• Organization memberships

Exports are provided in JSON format within 30 days of the request.

5. Exceptions

Data may be retained beyond the standard retention period when:

• Required by applicable law (e.g., tax retention requirements for payment records).
• Necessary for the establishment, exercise, or defense of legal claims.
• Subject to a valid legal hold or law enforcement request.

6. Review

This policy is reviewed at least annually and updated when new data categories are introduced or retention requirements change.

7. Contact

For data retention inquiries: privacy@createtodo.com