Data retention
How long each thing is kept
Windows are enforced by a nightly job, and each row names the code. Last checked against the code on 2026-09-18.
| Data | Kept | Deleted by | Code |
|---|---|---|---|
| Your subscription rows, reminder address and account hashes | Until you revoke | The Revoke button, one call | worker/src/db.ts deleteUserRows |
| Encrypted refresh token | Until you revoke | The same call; also revoked at Google | worker/src/google.ts revoke |
| Short-lived access token | Under one hour | Expires on its own in KV | worker/src/google.ts accessTokenFor, expirationTtl |
| Sign-in state during consent | 10 minutes | Expires in KV | worker/src/google.ts beginAuth |
| Reminder records, once sent | 90 days | Nightly purge | worker/src/retention.ts |
| Outgoing mail queue, once sent | 90 days | Nightly purge | worker/src/retention.ts |
| Model audit lines (only when the model pass is on) | 90 days | Nightly purge | worker/src/retention.ts |
| Visit counts (path, human or bot) | 90 days | Nightly purge | worker/src/retention.ts |
| Uptime checks | 30 days | Nightly purge | worker/src/retention.ts |
| Your account and list after you stop using nobill | 365 days idle | Nightly purge, counted from your last import | worker/src/retention.ts RETENTION_DAYS.idle_account |
| The aggregate count the landing page shows | Until you revoke | The same Revoke call; it is deleted with your rows | worker/src/db.ts deleteUserRows, table import_snapshots |
| Waitlist address and confirmation | Until you ask | Email [email protected] | worker/migrations/0001_init.sql waitlist |
| Nightly backup of every table | 30 days | Bucket lifecycle rule | worker/src/backup.ts; R2 bucket nobill-backups, rule expire-30d |
A backup taken before you revoked can hold your rows for up to 30 days after. Nothing reads backups except a restore drill, and the drill writes to a scratch database that is deleted afterwards. scripts/restore-from-r2.sh
Questions: [email protected], answered within two working days.