Effective September 3, 2026
Data Retention Standard
This standard applies data minimization, storage limitation, secure disposal, and defensible exceptions to Pro Shop Pal data.
| Data | Standard period | Disposition |
|---|---|---|
| Messages and uploaded images | 24 months from creation | Automatically deleted; unread sender-owned messages may be deleted sooner by the sender. |
| Active account/profile and shop assignment | While the account is active and needed | Deleted or de-identified after a verified deletion request, normally within 30 days. |
| Disabled account | Up to 90 days unless needed for a dispute, security, or legal obligation | Delete or de-identify direct identifiers and revoke access. |
| Sessions | Active session lifetime; expired or revoked records for up to 30 days | Automatically deleted. |
| Push tokens | While active; inactive records for up to 90 days | Automatically deleted. Invalid tokens are disabled promptly. |
| Security/administrative audit events | 24 months | Automatically deleted or de-identified. |
| Routine Nginx access/error logs | Normally 14 days | Rotated and deleted; relevant extracts may be held for an active incident. |
| Rolling operational backups | 14 days | Automatically expired. Deletions age out as backup generations expire. |
| Android releases | Newest two releases; additional releases only until 7 days old | Automatically deleted under the release-retention rule. |
Deletion requests
Send a request from the account email to admin@kriek.dev. Identity will be verified. Access is revoked before deletion processing where appropriate. Completion is normally within 30 days, and backup copies expire through the rolling backup schedule.
Exceptions
A narrowly scoped legal hold may pause deletion when required by law, a valid legal request, payment/dispute defense, fraud prevention, or an active security investigation. Holds are documented, access-restricted, reviewed periodically, and released as soon as the reason ends. Data is not retained indefinitely merely because it may someday be useful.
Secure disposal and review
Application records are deleted from active systems and attached files are removed from managed storage. Physical media disposal is handled by infrastructure providers. Retention jobs run daily and are monitored. This standard is reviewed at least annually and whenever the service materially changes.
Contact
Pro Shop Pal · admin@kriek.dev
Privacy Policy