1. Design principles
- Local-first: by default your files are processed on your own device and never uploaded — so for most jobs there is nothing on our servers to retain or delete.
- Metadata-only records: job records contain counts, byte sizes, formats, status, and timestamps — never file contents, extracted text, or image pixels.
- Every stored item has a lifetime: anything we do store has a defined retention period and an automated or documented deletion path.
2. Retention schedule
| Data | Retention | How deletion happens |
|---|---|---|
| Files in local (on-device) jobs | Never received by us — nothing to retain. | Browser-side working data (e.g., IndexedDB job state) stays on your device and is cleared by your browser or by you. |
| Files in cloud jobs (inputs & outputs) | Temporary only; auto-deleted within [Pending owner/lawyer: tiers, e.g., 1 hour default / 24 hours extended / enterprise custom] from job completion. Backup/log residue: [Pending owner/lawyer: specify, e.g., ≤ 7 days]. | Automated lifecycle rules on temporary object storage, monitored with alerting on failure. (Cloud processing is still being rolled out; this schedule takes effect when it launches.) |
| Job metadata (job type, file counts, input/output bytes, formats, status, timestamps) | [Pending owner/lawyer: e.g., 12 months, then aggregated/anonymized] | Scheduled deletion or anonymization jobs. |
| Account data (email, name, plan state, saved presets) | While your account is active, plus [Pending owner/lawyer: e.g., 30 days] after a deletion request. Billing records are kept longer where tax law requires ([Pending owner/lawyer: e.g., 7 years]). | In-product account deletion [Pending owner/lawyer: self-serve deletion is being rolled out — until then, email us] or contact info@geniefolder.com. |
| Email-verification tokens | Single-use; expire 24 hours after issue. Requesting a new link invalidates earlier ones. | Automatic expiry; consumed on first use. |
Session tokens (gt_access / gt_refresh) | Access tokens live about 15 minutes. Refresh tokens live up to 30 days and are rotated on every use; only their SHA-256 hash is stored. Re-using an old (rotated) token revokes all of your sessions as a compromise precaution. | Automatic expiry and rotation; signing out or changing your password revokes them immediately. |
| Team invitation links | Expire 7 days after issue. | Automatic expiry. |
| Cloud-connector OAuth tokens (Google Drive / OneDrive) | Stored encrypted while the connector is linked; deleted within [Pending owner/lawyer: e.g., 30 days] after you disconnect, except minimal security audit records. | Revocation and deletion on disconnect. |
| Server / security logs (IP address, device type, error codes) | [Pending owner/lawyer: e.g., 30 days], then deleted or anonymized. | Automated log rotation. |
| Billing records (invoices, subscription status) | Card data is held by our payment processor (Square), not by us. Our billing records are kept for the period required by tax and accounting law ([Pending owner/lawyer: e.g., 7 years]). | Deletion at the end of the statutory period. |
3. Files in your own connected storage
Outputs you save to your own Google Drive or OneDrive are governed by your account with that provider. Disconnecting a connector in GenieFolder revokes our access tokens as described above but does not delete files already saved in your storage — they are yours.
4. Requesting deletion
You can exercise deletion and other data rights at any time by emailing info@geniefolder.com from your account address. We respond within [Pending owner/lawyer: 30 days / statutory period]. See the Privacy Policy (Section 7) for the full list of rights.
5. Changes to this policy
Changes will be posted on this page, and registered users will be notified of material changes as described in the Privacy Policy.