Your content is encrypted with keys we never hold. Deleting an item destroys the sealed key alongside the ciphertext, so any residual bytes in a backup window are permanently undecryptable — by us or by anyone else.
Data categoryRetentionLegal basisDeletion mechanism
Encrypted file content (ciphertext)Until the user deletes it, or 30 days after account closurePerformance of contract (art. 6(1)(b))Object deleted from storage; the sealed file key is destroyed, making any residual bytes undecryptable
Trash (soft-deleted items)30 days, then permanent purgePerformance of contract — accidental deletion protectionDaily scheduled purge job; user can empty trash instantly
File and folder metadata (encrypted names, sizes, versions)Same lifecycle as the object it describesPerformance of contractRow deleted with the object; cascade on account purge
Account record (email, region, plan)Life of the account + 30-day grace periodPerformance of contractGrace period allows cancellation of deletion; then hard delete
Security audit log (action, timestamp, IP, user agent)12 monthsLegitimate interest — fraud and intrusion detection (art. 6(1)(f))Append-only table with rolling purge; entries anonymised on account deletion
Session and device recordsUntil revoked, or 90 days of inactivityLegitimate interest — account securityAutomatic expiry; user can revoke any session at will
Billing and invoice records10 yearsLegal obligation — accounting and tax law (art. 6(1)(c))Retained by the payment processor and in our invoice ledger; contains no file data
Off-site backup snapshots30 days rolling (immutable object lock)Legitimate interest — disaster recoveryEncrypted before leaving our infrastructure; snapshots expire automatically and cannot be altered during the lock window
Transactional email delivery logs30 daysLegitimate interest — deliverability troubleshootingHeld by the email subprocessor, then purged
Support correspondence24 months after the ticket is closedLegitimate interest — service quality and dispute handlingManual deletion on request at any time
You can empty the trash instantly instead of waiting for the 30-day purge, export everything as a structured archive at any moment, and close your account with a 30-day grace period that you can cancel. After the grace period the purge is irreversible and we will certify it in writing on request.