Data Retention & Lifecycle Policy

Last updated: September 14, 2026 · LifeOS v1.0.0

Overview

This policy describes how LifeOS retains, deletes, and governs user-related data in the running product on lifeos.vision. It is intended to match actual implementation behavior. It does not claim legal compliance in any specific jurisdiction; operators and users should consult applicable local requirements.

For cookies and browser storage, see the Cookie & Storage Policy. For permanent account deletion steps, see the Account Deletion Policy.

Active Account Data

While your account is active, LifeOS retains the productivity data you create or upload (planner, calendar, finance, memories, habits, voice library files, settings, and related records) in the production database and durable media storage until you delete individual items, deactivate, or permanently delete your account.

LifeOS does not currently auto-delete inactive or deactivated accounts. Deactivation preserves your data until you reactivate or permanently delete.

Enforced Time Limits (Application Code)

The following limits are enforced by LifeOS today:

Sign-in session (lifeos_session): Up to 30 days absolute lifetime; 12 hours idle timeout; browser-session behavior when “Remember me” is not selected. See the Cookie & Storage Policy.
Password reset token: 15 minutes, then cleared on successful reset or expiry.
Email verification token: 24 hours, then invalid until a new verification message is requested.
Marketing unsubscribe token: Up to 1 year (8760 hours), then cleared when used or expired.
AI response cache (when Redis or in-memory cache is used): Default 1 hour TTL for generic cached replies (LIFEOS_AI_CACHE_TTL, operator-configurable).
Temporary upload staging files: Background cleanup removes aged .tmp / staging files after about 24 hours by default (LIFEOS_CLEANUP_MAX_AGE_SEC, operator-configurable).
Voice conversation context (Ask LifeOS): Kept only in your active server session, capped at 6 user+assistant turns; not stored as a persistent chat history table. Cleared when the session ends or you clear voice session state.
Rate-limit / throttle counters: Short-lived (for example, 15-minute windows) for login, signup, and API abuse protection.

Data Without an Application-Enforced Expiry

LifeOS does not currently run automated purge jobs for the following while your account remains active or after deactivation:

Planner, finance, memory, habit, sync, and settings records
Monthly ai_usage quota counters (historical months accumulate until account deletion)
Privacy request records and consent audit rows
User media files on the durable volume

Security, Request, and AI Telemetry Logs

LifeOS may emit security events, request logs (when enabled), and AI usage telemetry (provider, latency, token/cost metrics) to server logs and optional operator tools such as Sentry. LifeOS does not enforce a fixed retention TTL for these logs in application code. Actual retention depends on hosting log settings, operator configuration, and any third-party monitoring retention you enable. Contact the operator if you need the current production log retention window.

Admin Audit Records

Super Admin actions (for example, user suspension or deletion performed by an administrator) are recorded in admin_audit_log. These records are retained for operational accountability and are not removed when a user account is permanently deleted.

Consents and Privacy Requests

Signup consents (terms, privacy, age attestation), optional marketing consent, and privacy access/correction/deletion requests are stored while your account is active. When eligible permanent deletion succeeds, these rows are removed with your account. They are not retained as a separate post-deletion archive inside LifeOS.

Billing and Payment Records

LifeOS stores billing subscriptions, invoices, transactions, payment events, and related audit rows while your account exists. Accounts with successful paid billing history cannot be permanently deleted from Settings; billing records remain because the account is retained. You may deactivate the account or contact support for assistance.

When permanent deletion is allowed (no paid billing block), LifeOS removes per-user billing rows as part of the delete transaction. Payment processors (for example, Razorpay) and app stores may retain their own records under their policies.

User Media

Memory attachments, profile photos, wallpapers, and voice library files are stored on the production durable media volume (and optionally mirrored to operator-configured object storage when enabled). They persist until you delete the item, delete your account, or an administrator removes them. Temporary staging files follow the cleanup schedule above.

Deactivated Accounts

Deactivation disables sign-in but preserves all account data until you log in and reactivate or permanently delete (when eligible). There is no automatic deletion after a period of inactivity.

Permanent Account Deletion

When eligible deletion succeeds, LifeOS removes your user row and associated application data from the active database and deletes collected user-owned media files from production storage. See the Account Deletion Policy for the full deleted vs retained list.

Infrastructure Backups

Live deletion vs backups: Eligible permanent deletion removes data from the active LifeOS database and production media paths at deletion time. Separately, the operator may maintain infrastructure backups (for example, database volume snapshots, logical dumps, or point-in-time recovery) for disaster recovery.

Residual copies: Deleted account data may still exist inside encrypted infrastructure backups until those backups reach their configured expiry and are rotated out. LifeOS does not control third-party backup retention schedules from this policy page; actual backup cadence and retention are operator-configured and may vary by deployment.

Infrastructure backups are not used to restore a deleted end-user account on request. They exist for platform recovery only.

Third-Party Provider Retention

Email (for example, Resend), payment (Razorpay, app stores), optional AI providers, and optional monitoring services may retain data they process according to their own policies. LifeOS does not control those retention periods.

Changes

We may update this policy as LifeOS evolves. Material changes will be noted in Release Notes and by updating the effective date on this page.