Retention statement
Short by default. Observable when it matters.
Document objects are processing inputs and outputs, not a permanent drive. Application deletion is primary; storage lifecycle is only a safety net.
Development draft — this page is local product evidence, not an approved public policy or legal commitment.
Current default schedule.
| Data | Default | Control |
|---|---|---|
| Browser-local source and output | Current session | User downloads or saves the new copy |
| Cloud input | Delete when no longer needed | Immediate-delete workflow plus lifecycle backstop |
| Cloud output | 1 hour after successful processing | Delete now remains available until confirmed |
| Failed or cancelled job objects | Delete immediately | 24-hour maximum lifecycle backstop |
| Opt-in job metadata | 30 days | Content-free fields only; preference can be turned off |
| Billing and security records | Approved legal/security schedule required | Never used to reconstruct deleted document bytes |
Deletion needs proof, not intention.
The trusted reconciler deletes idempotently, confirms storage absence, retries with bounded backoff, marks repeated failures for attention, and looks for orphan objects. Production alert delivery and a storage-inventory exercise remain release gates.