Most of this table says “never”.
Retention is the one privacy claim that can be checked against reality, because the record either exists or it does not. What follows is the complete list, including the entries that are inconvenient for us.
The principle, such as it is
None of this is clever. We worked out which records the service genuinely cannot run without, and stopped collecting everything else.
Data never written cannot be produced, subpoenaed, leaked or sold.
Each log has to survive one question: what breaks if it does not exist? Panel access logs survive it, because account takeover is a real event and seven days is enough of a window to catch one. Flow records do not survive it, so no router in the fleet is configured to export any.
Rule two is that retention runs on a timer rather than on good intentions. Deletion is a scheduled job, executed against production and against every backup generation that has aged past its own window. Nobody has to remember to purge anything, which is fortunate, because nobody would.
The table
Generated from the same configuration the deletion jobs read.
| Data | Retention | Why it exists | How it goes |
|---|---|---|---|
| Email address | Life of the account | Password resets and invoice delivery | Overwritten within the hour on closure |
| Password hash | Life of the account | scrypt, per-account salt, never reversible | Overwritten on closure |
| Session records | 14 days, or until sign-out | Keeping you signed in and letting you kill a device | Deleted at expiry, hourly sweep |
| Recovery codes | Until used or regenerated | The only account recovery path that exists | Hashed; the hash is dropped on regeneration |
| Panel access log | 7 days | Detecting account takeover | Row deleted; the address was already truncated |
| API token metadata | Life of the token | Scope, prefix, last use, expiry | Deleted with the token |
| Invoice records | 24 months | So you can prove what you bought and when | Deleted on the anniversary sweep |
| Crypto payment reference | Until the invoice settles | Matching a payment to an invoice | Purged on settlement, same transaction |
| Support tickets | 90 days after closure | Continuity while a problem is still live | Thread and attachments deleted together |
| Abuse reports | 12 months | Recognising a repeat complainant or a repeat offender | Deleted with the complainant details |
| Billing database backups | 30 days rolling | Recovering from our own mistakes | Generation expires and the volume is trimmed |
| Console session metadata | 7 days | Knowing a tunnel opened, nothing about its contents | Deleted with the access log |
| Instance traffic | Never recorded | We route packets rather than read them | There is nothing to delete |
| DNS queries | Never recorded | Resolvers answer and forget | There is nothing to delete |
| Network address at sign-up | Never recorded | The application has no column for it | There is nothing to delete |
| Snapshot and backup contents | While you keep them | Encrypted to your key before leaving the instance | We hold ciphertext and a length |
The account page in the panel shows this same list with your own values in it and a live countdown beside each timer. Anything absent from that page is absent from our disks.
Never written, at any point
The shorter list matters more. These are not brief retentions; they are absences.
Traffic through your instance
No flow export, no sampling, no packet capture, no inspection of any depth. Routers count bytes per port for capacity planning and know nothing whatever about the packets that made them up.
Your network address at sign-up
The web tier does not forward it to the application, and the application has nowhere to put it. Panel access logs keep a truncated prefix for seven days and never the full address.
DNS queries
Our resolvers answer and forget. Query logging is off in the configuration, and it is the same configuration that ships to all thirty-four sites.
Console sessions
Serial and VNC run through an authenticated tunnel that records nothing. We know a session opened and closed. What was on the screen is yours.
Instance contents
Disks, memory, snapshots. Backups and snapshots are encrypted inside the instance before they leave it, so what sits on our storage is ciphertext with a length attached.
Anything belonging to a third party
No analytics, no advertising pixels, no tag manager, no externally hosted fonts. The page you are reading makes no request to anybody but us, which you can confirm in about four seconds with a network tab.
How deletion actually works
- 01
The timer fires
Hourly, per category, against the primary database and object storage in the same pass.
- 02
Rows are removed, not flagged
Deleted means gone, with a tombstone that carries no payload. Soft-delete columns were taken out of the schema in platform revision 5.1 for exactly this reason.
- 03
Backups age out
Billing backups roll on a thirty-day window, so a record deleted today survives in a backup generation for at most thirty days more. Behind that window there is no archive, no tape and no cold copy.
- 04
Logs stay local
Host logs are not shipped anywhere. Each machine rotates its own, and rotation truncates rather than uploads.
- 05
Closure is complete
Close an account and the address, hash, sessions and tokens go inside the hour. Invoice records serve out their twenty-four months with nothing identifying attached to them.
What short retention does not do
Keeping almost nothing protects you from us, from a request served on us, and from whatever we might one day lose in a breach. It does nothing about the networks between you and your instance, which observe traffic we never touch, and it does nothing about what your own software writes to your own disk.
Two consequences follow, both practical. Your application logs are yours, they sit on your storage, and unless you turn it off they will cheerfully record the address of every visitor you serve. A snapshot of a running instance likewise contains whatever was in memory and on disk at that moment, encrypted to your key rather than ours, which is protection against us and no protection whatsoever against the key sitting unguarded in a password manager.
Better to say that here than to let a table full of the word “never” imply more than it should.
Read the policy against the panel.
Every timer on this page appears in your account page with a live countdown beside it. If the two ever disagree, the panel is the truth and the page is the bug — tell us and the page gets fixed the same day.