Policy
Data Retention & Deletion Policy
- Effective date:
- November 4, 2026
- Next scheduled review:
- June 11, 2027
- Owner:
- Bethel Ventures, LLC · Information Security Lead: Bethel Ventures, LLC
- Contact:
- support@hellosolomon.com
1. Purpose & scope
This policy defines how SOLOMON retains and deletes the data it processes on behalf of its users. It applies to all data stored, transmitted, or processed by SOLOMON, including account credentials, user-generated content, financial data received from Plaid, and data received from other connected third-party services.
2. Governing principles
- Data minimization. SOLOMON collects only data needed to deliver the user-facing features each user has enabled.
- Purpose limitation. Data collected for one purpose is not repurposed without the user's explicit consent or a clear update to the Privacy Policy.
- User control. Users may export, modify, or delete their data at any time via the in-app interface.
- Honest defaults. Data is retained only as long as it serves the user, after which it is deleted in the ordinary course of operation.
3. Retention schedule by category
| Data category | Retention period | Reason |
|---|---|---|
| Account record (email, password hash, name) | Until account deletion | Required to provide service |
| Session tokens | 30 days from last use | Reduces risk of long-lived session theft |
| Sign-in activity, successful and failed (audit log) | 90 days | Security incident investigation |
| Two-factor authentication seed | Until 2FA is disabled or account deleted | Required for ongoing authentication |
| User-created content (journal, tasks, goals, memory, etc.) | Until user deletes it or account deletion | User-owned content; user controls lifecycle |
| Chat history with SOLOMON | Until user deletes it; user-initiated bulk-delete via /settings → Chat hygiene | User-controlled cleanup |
| Bank transactions (Plaid) | Until institution disconnect or account deletion | Past-year tax filings and historical reporting |
| Bank account metadata (Plaid) | Same as transactions | Required to keep transactions interpretable |
| Receipts (image + extracted fields) | Until user deletes it or account deletion | Required for tax substantiation |
| Third-party access tokens (OAuth, API) | Until integration disconnected or account deletion | Required to keep integration active |
| Operational event log (events table) | 90 days | Operational audit + user transparency |
| Record of actions SOLOMON took (agent actions) | 180 days | “What did SOLOMON do last week?” + user transparency |
| Inbox sorting results (category + one-line reason per message, never the message) | 90 days, or at once when the last Google account is disconnected | Avoid re-sending mail to an AI model |
| Server access logs (Fly platform) | 30 days (platform default) | Operational debugging |
| Encrypted nightly backups of the database (AES-256-GCM, mirrored off-site) | Newest 14 kept; older ones deleted automatically | Disaster recovery |
4. User-initiated deletion
Users may delete data at the following granularities, available at any time:
- Individual item — any single journal entry, task, receipt, memory, etc., is deletable from its own surface.
- Surface or feature — bulk-deletion of chat history (Settings → Chat hygiene), bulk-deletion of memories (/memory), bulk-disconnect of integrations (Settings → Connections).
- Institution-scoped scrub — disconnecting a Plaid institution from /finances removes all stored accounts and transactions associated with that institution within seconds.
- Account-wide deletion — Settings → Delete account immediately cancels any subscription, severs bank and Google connections, and permanently removes all account content, sessions, integrations, audit logs and uploaded files. Deletion is irreversible.
5. Enforcement
Retention windows are enforced programmatically in code. Session tokens are validated against their stored expiry timestamp on every request. Sign-in records older than 90 days are purged by a weekly sweep. Account-deletion requests cascade through every table holding user-scoped data via the user-tenant context (`runAsUser`), ensuring no orphaned rows remain.
User-initiated deletions are not soft deletes — the underlying rows are removed from the production database. Encrypted nightly backups that may still contain the data are kept for up to 14 days and then permanently overwritten, after which a deleted record is unrecoverable. Backups are never used to restore a deleted account unless the user asks.
6. Compliance with applicable law
This policy is intended to comply with applicable data privacy laws, including:
- California Consumer Privacy Act (CCPA / CPRA) — right to know, right to delete, right to opt out of sale (SOLOMON does not sell data)
- General Data Protection Regulation (GDPR) — Article 17 right to erasure, Article 20 right to data portability (export endpoint)
- Gramm-Leach-Bliley Act (GLBA) — when handling financial data received via Plaid
Users may exercise their rights by emailing the contact above or using the in-app deletion controls. Responses are provided within 30 calendar days.
7. Review & revision
This policy is reviewed at least annually, on or before the next scheduled review date listed at the top of this document. The policy is also reviewed whenever:
- A new category of data is introduced into the product
- A new third-party processor is added
- An applicable data privacy law is enacted or materially amended
- A security incident reveals a gap in current practice
Material changes to this policy are surfaced to users in-app at next sign-in and updated on the public Privacy Policy at solomon-life.fly.dev/privacy.
8. Contact
Questions, deletion requests, or compliance inquiries: support@hellosolomon.com.