# Data Retention and Deletion Policy

**Parallel Systems · Effective June 15, 2026 · Version 1.2**

## Purpose

This policy defines how Parallel Systems retains and deletes user data across all systems for the Abilli mobile application. It applies to data stored on user devices, in our Supabase backend, and in any third-party services.

## Data Categories and Retention Periods

### On-Device Data (User-Controlled)

| Data Type | Retention | Deletion Method |
|-----------|-----------|-----------------|
| Scanned receipts and purchase history | Until user deletes or uninstalls | App uninstall or manual delete in app |
| Shopping lists, wishlists, watched items | Until user deletes or uninstalls | App uninstall or manual delete in app |
| Subscription tracking | Until user deletes or uninstalls | App uninstall or manual delete in app |
| App preferences and settings | Until user deletes or uninstalls | App uninstall |
| Cached ownership data | Refreshed periodically, cleared on uninstall | Automatic or app uninstall |

Abilli does not have access to on-device data. Users have full control over deletion.

### Backend Data (Supabase)

| Data Type | Retention | Deletion Trigger |
|-----------|-----------|-----------------|
| Anonymous session identifiers | Indefinite (no PII attached) | Supabase session expiry |
| Community votes (anonymous) | Indefinite (for system integrity) | N/A — anonymous, no PII |
| Verified votes (Tier 2+) | Indefinite (governance record) | Account deletion request |
| Boycott campaign proposals | Indefinite (community record) | Community moderation |
| Community flags and reports | 90 days after resolution | Automatic cleanup |
| Anonymized spending snapshots | Indefinite (no PII) | N/A — aggregate data |
| Leverage contributions | Indefinite (campaign integrity) | Account deletion request |
| Member records (email link) | Until account deletion | User-initiated deletion |
| Plaid transaction history (Pro, bank-linked) | Until bank unlinked or account deletion | User-initiated unlink / account deletion |
| Plaid access token (server-side, encrypted) | Until bank unlinked or account deletion | User-initiated unlink / account deletion |

### Verified Account Data

| Data Type | Retention | Deletion Method |
|-----------|-----------|-----------------|
| Email address | Until account deletion | User request via app or email |
| OAuth tokens | Session-based | Automatic on sign-out |
| Display name | Until account deletion | User request |
| Participant ID mapping | Until account deletion | Cascading delete with account |

### Infrastructure and Logs

| Data Type | Retention | Deletion Method |
|-----------|-----------|-----------------|
| Codemagic build logs | Per Codemagic default (30 days) | Automatic |
| Supabase audit logs | Per Supabase default | Automatic |
| Error logs | 30 days | Automatic |

## Deletion Procedures

### User-Initiated Deletion

**Anonymous users (Tier 1):**
- Uninstall the app to delete all on-device data.
- Anonymous session data on the backend contains no PII and is not linked to any identity.

**Verified users (Tier 2+):**
- In-app: Settings → Delete Account. Shipped — the app calls the `delete-account`
  backend function, which removes the server-side records listed below.
- By email: Send a request to privacy@abilli.app.
- Processing time: Within 30 days of request.
- What is deleted: Email, display name, member record, auth-to-participant mapping, leverage contributions linked to participant ID.
- What is retained: Verified votes are anonymized (participant ID removed) to maintain governance record integrity. Anonymized aggregate data is retained.

**Plaid-linked users (Pro bank linking):**
- For Pro members who opt to link a bank, we retrieve up to 24 months of transaction history (merchant, amount, date, category), stored encrypted at rest in Supabase, alongside a server-side encrypted Plaid access token.
- Retention: a rolling 24-month window — transactions older than 24 months are purged nightly. Disconnecting the bank (or deleting the account) removes the rest immediately.
- The bank connection can be revoked at any time via app settings. Revoking the connection (or deleting your account) deletes all stored transaction data and revokes the Plaid access token.
- No bank login credentials are stored by Abilli at any point — Plaid handles authentication.

### Automated Deletion

- Resolved community flags: Automatically deleted 90 days after resolution.
- Expired anonymous sessions: Cleaned up per Supabase session management defaults.

### Data Breach Response

In the event of a data breach affecting personal data, affected users will be notified within 72 hours via available channels (email for verified users, in-app notification and Discord for all users).

## Compliance

This policy is designed to comply with:
- **PIPEDA** (Personal Information Protection and Electronic Documents Act) — Canada
- **BC PIPA** (Personal Information Protection Act) — British Columbia
- **GDPR** principles (data minimization, right to deletion) — applied as best practice

## Review Schedule

This policy is reviewed annually or when significant changes are made to data handling practices. The next scheduled review is March 2027.

---

*Parallel Systems · Gabriola Island, BC, Canada*