Data Retention & Deletion Policy
This policy defines how long Above Water keeps user data and how it gets deleted. It exists to satisfy the data-minimisation principles in the CCPA and GDPR and Plaid's data-handling requirements — and, more usefully, so that you can find out exactly what happens to your data without asking.
1What we keep, and for how long
| Data | Where it lives | Retention |
|---|---|---|
| Account and authentication data | Supabase Auth | Kept while the account is active. Deleted 14 days after you request deletion in the app. |
| Plaid access tokens | Supabase Postgres, encrypted | Revoked immediately when you disconnect a bank. If you ask to delete your account, revoked 48 hours after your request unless you choose to keep your account, then deleted. |
| Account and balance data from Plaid | Supabase Postgres | Kept only while needed to render your widgets. Deleted when you disconnect that bank in the app, and 14 days after an account deletion request. |
| Balance history | Supabase Postgres | Daily per-account balance snapshots, kept 13 months, used to render trend widgets. Deleted when you disconnect that bank in the app, and 14 days after an account deletion request. Re-linking a bank keeps its history, so its trend carries over. |
| Deletion Record | Supabase Postgres | We keep your email address, when you asked for deletion and when it was carried out, and your reason for leaving if you gave one, for 12 months, only to answer questions about the deleted account. We never use it to contact you. |
| Subscription state | Supabase Postgres | Kept while the subscription is active, then as long as needed for tax and accounting records. |
| Usage analytics | PostHog Cloud | Up to 12 months, then purged or anonymised. |
| Crash and error reports | Sentry | Up to 90 days. |
| Support correspondence | Up to 24 months, for continuity if you write again. | |
| Waitlist email (pre-launch) | Supabase Postgres | Up to 12 months from signup, then deleted automatically by a scheduled job. Used only for emails about Above Water (launch notice, beta invites, progress updates, feedback requests); removable any time by emailing support@lavafactory.com. |
2How deletion works
Two different actions, with two different effects:
Disconnecting an account
Available in the app at any time. We revoke the Plaid access token immediately, which ends our ability to retrieve anything further from that institution. The cached balances for that account are removed, and any widget showing them stops updating. Your Above Water account stays.
Deleting your account
Delete your account in the app, with the Delete account button next to Sign out. Your banks stay connected for the first 48 hours, so nothing is lost if you change your mind. If you haven't kept your account by then, bank access is revoked. Your account, authentication record, and all stored balance data are deleted 14 days after the request, and the app shows you that date. You can keep your account at any point before then; if you keep it after the first 48 hours, the account stays but you'll need to link your banks again. Analytics events are deleted or anonymised so they can no longer be tied to you.
If you can't sign in, email support@lavafactory.com from the address on the account and we'll do it for you.
Three things survive, and only these: records we're required to keep for tax and accounting purposes relating to a paid subscription, support correspondence within the window above, and the Deletion Record described above. Any backup copies age out on the providers' own backup schedules.
3Manual today, automated soon
Most retention is currently enforced by hand. Some windows already purge on a schedule — waitlist emails, and daily balance-history snapshots past 13 months. For everything else, a scheduled purge is planned but not yet built; until it exists, account deletions are carried out by hand on the Deletion Date, 14 days after the request — and that commitment holds regardless of whether the automation exists.
4Legal basis
The periods above are set to the shortest span that still lets the product work, in line with the data-minimisation and storage-limitation principles in the GDPR and the CCPA, and with Plaid's developer data-handling requirements. We do not retain financial data longer than the service needs it, and we do not keep it "in case it's useful later".
5Review
This policy is reviewed at least annually, and sooner if our data handling, infrastructure, or the applicable law changes. The effective date at the top reflects the last review.
Related: the privacy policy covers what we collect and why; the security overview covers how it's protected.