Data retention policy

Last updated 2026-08-01

Draft — HAVE COUNSEL REVIEW. Retention periods below are our stated policy but have not been reviewed by an attorney. Do not remove this marker until they have.
WhatHow longNotes
Child profile (nickname, avatar, birth year)While the account is openDeleted immediately when you delete the profile or withdraw the first permission
CardsWhile the account is openArchived cards are purged 180 days after archiving
Card photosWhile the card existsDeleted with the card
ConnectionsWhile activeDeclined and revoked connections are purged after 90 days
Identity check images and selfieNot stored by usRedaction requested from Stripe immediately on a verified result
Identity check outcome and timestamp7 yearsKept as the record that consent was properly obtained
Consent records7 years after withdrawalNever deleted on withdrawal — the history is the compliance record
Parent email and display nameWhile the account is openDeleted 30 days after account closure
Wallet balances and ledger entries7 yearsFinancial record-keeping
Shipping addresses on print orders2 yearsThen deleted from the order record
Audit log7 yearsAppend-only security and compliance record
Payment recordsAs Stripe requires, typically 7 yearsHeld by Stripe as processor