Legal
Retention
Active workspace records remain while the workspace is open.
Account deletion has a seven-day cancellation window. It disconnects connected accounts, revokes tokens and sessions, removes Google identity links, and pseudonymizes profile fields.
Immutable app versions, snapshot provenance identifiers, and audit records may remain as workspace records after a person is deleted.
Transactional email bodies containing one-time links are cleared after successful delivery.
Backup and closed-workspace purge windows are documented in the operations runbook and verified by restore drills before public signup opens.