1. Purpose-limited retention
Personal information must be kept only as long as needed for its specific documented purpose, with a defensible review/deletion trigger. Keeping a private account, retrying a failed job, protecting against abuse and meeting an accounting obligation are different purposes. Children’s media must not be retained merely because a transaction record needs to be kept.
This review version distinguishes behavior found in the current source from operating periods that have not been established. It must not be published as a fully implemented retention promise until those decisions and controls are verified.
2. Current behavior and unresolved periods
| Information | What the reviewed implementation establishes |
|---|---|
| Unclaimed guest onboarding sessions | A session expires seven days after creation. The backend has scheduled cleanup for expired unclaimed session/job records and stored previews. Cleanup depends on the deployed scheduler and successful storage/database operations; expiration does not prove simultaneous provider erasure. |
| Unchosen avatar previews | Approval/discard logic marks unwanted previews and deletes related stored image/head-image objects, with cleanup retry support. Minimum job/state metadata may remain for idempotency and generation accounting. Full metadata retention must be finalized. |
| Reference-photo request inputs | A selected photo can be sent to the generation provider with a job. No verified, end-to-end lifetime for every provider input/log/cache has been established in this audit. An exact production period must be agreed and enforced. |
| Claimed profiles, approved characters, song/lyric records and generated media | Retained for the family service and saved content as configured. A complete account/inactivity retention and backend erasure process remains to be verified; local removal alone does not perform it. |
| Saved adult voice sources and derived media | A recording can remain on the device for reuse and can be uploaded for a song. A separate backend voice-source deletion queue exists, but it is not proof of end-to-end deletion for every local audio path and provider. Exact periods and revocation propagation require verification. |
| Local data and sign-out archives | Preferences/media may remain in app/browser storage. Sign-out can preserve an account-scoped local archive for restoration. They remain until the corresponding local data is removed; device/browser copies and backups require separate handling. |
| Support, security logs, backups and legal records | The audit did not establish final service-wide periods. Set purpose-specific periods and backup expiry, restrict legally retained records and verify the relevant provider settings before release. |
3. Deletion requests and exceptions
Start a request at Delete Account & Data or email [email protected]. We verify identity/authority, determine scope and explain timing. Where UK/EU GDPR applies we normally respond within one month, with any lawful extension explained. That statutory response rule is not a substitute for testing the actual deletion workflow.
Only minimum records needed for a specific legal obligation, security incident or dispute may be kept under an applicable exception. We must explain the category, purpose and period unless the law prevents disclosure. Deleted data should not be put back into active use by a backup restore; any restore needs to reapply relevant deletion instructions.
4. Different controls have different effects
- Hide from Kids Mode: changes visibility, not storage.
- Remove on this device: removes the relevant local entry/copy; it may not remove cloud/provider copies or a separate archive.
- Sign out: ends the active account session and can retain an account-scoped local archive.
- Uninstall: does not itself instruct our backend to close an account or erase retained records.
- Delete account/data: a separate request for the indicated account, profile, source and/or output records.
- Cancel subscription: stops renewal under store terms; it is separate from account/data deletion.