Retention Policy

Every refresh from an authorized financial or document connector (for example, Plaid) deletes the prior snapshot from that same source as soon as the new one is safely written. The corpus holds exactly one live snapshot per source at any time. Stale snapshots are not archived; they are removed from both the database and object storage.

Documents you upload to your corpus (PDFs, images, CSVs) are kept indefinitely, along with the AI-extracted markdown rendering, until you delete them from the Corpus screen or via account deletion. The original file and the extracted markdown are deleted together.

When you dismiss a brief, it is suppressed from the planner for 90 days. After that, if the underlying issue is still present in your corpus, it may resurface — because a genuinely persistent problem (a recurring fee, an unclaimed benefit) should not be silenced forever by a single dismissal. Briefs you have acted on are remembered indefinitely so the planner never re-proposes work you have already done.

Action threads (the guided conversations where you work through a brief and the recorded outcome) are kept indefinitely. They form your history with the system — the realized impact tally that crowns the feed is grounded entirely in this record. You can delete an individual thread, or all of them via account deletion.

Concerns you raise and the documents you attach to them are kept until you delete the concern (which removes the concern, its attachments, and the briefs the focused swarm produced for it) or close your account.

Every investigation run is recorded in an audit table (id, timestamp, status, brief count, any AI error). The record contains no document content — only metadata. It is kept indefinitely so problems can be diagnosed weeks or months later.

Standard hosting and database logs (IP, route, timestamp) are retained for the duration the upstream providers default to — currently 90 days for Vercel function logs and the Supabase default for Postgres logs. These logs do not contain document content, financial figures, or other personal data extracted from your corpus.

You can delete your account yourself, at any time, from Settings → Delete account. Deletion runs immediately and removes:

• your auth record (email, passkey credentials);
• every row in every table keyed to your user id (corpus items and their search index, briefs, concerns, action threads, reminders, obligations, investigations, connector links, snapshots, plan and usage records, device push tokens);
• every object in object storage under your account (original uploads, concern attachments, and rendered markdown);
• stored connector tokens. Linked Plaid accounts are also disconnected at Plaid, so it stops accessing your bank data; if Plaid can't be reached at that moment, the connection and its token are still deleted from Done.

If you can't sign in, email hello@quobo.co from the address on the account; confirmed requests are completed within 30 days. If your country's law sets a shorter window, that window applies.

Some copies live briefly outside Done and expire on the provider's schedule: operational logs held by hosting/database providers (typically 90 days), and recent requests held by our AI providers (Anthropic deletes API inputs and outputs within 30 days by default).

Supabase maintains automated database backups per its standard retention. A deletion request also clears your data from the next backup taken after the deletion completes; older snapshot backups roll off on the provider's schedule and are not user-restored once a deletion request has been processed.

This policy is reviewed whenever the data model materially changes. The current revision is dated at the top of the page.

See also: the Terms of Service for the agreement governing the Service, the Privacy Policy for what is collected, why, and which service providers process it.

hello@quobo.co