Data retention

Version 2026-09-30 · covers the private pilot of Terms of Us

This is the public summary of how long we keep each kind of data, and what happens to each when you withdraw. It is generated against the same behaviour table the deletion code consults — if the product gains a kind of data, this page cannot build without a row for it.

The pilot rule, first

Everything below sits inside one overriding rule for the pilot: pilot data is kept for the duration of the pilot, then deleted — unless you explicitly ask to carry it into the live service under the launch privacy notice. The durations below describe how the product behaves while it runs.

The schedule, per kind of data

Every row says what ends that kind of data. Where the end is a fixed period, the row says so in bold and gives you the number, and the product deletes on exactly that number rather than only promising it here. Where the end is something you do — deleting an entry, or your account — the row says that instead.

Your Sounding answers: The 48 statements you answered, verbatim. Never shown to your partner. Blind Spot’s twenty-four statements about your partner are deleted when they take back their agreement to it.Kept: Until you delete your account; deleted at once then.See the open question on re-scoring below.If you withdraw: Deleted absolutely, immediately.Once deleted here, it is gone from backups within 30 days.
Your scores: The six dimension scores derived from your answers.Kept: Until you delete your account. A copy survives only inside a signed agreement’s frozen report, and follows that report’s rule.If you withdraw: Deleted from the live service.Once deleted here, it is gone from backups within 30 days.
Your survey: Your archetype and Your Survey — the report only you see.Kept: Until you delete your account; deleted at once then.If you withdraw: Deleted absolutely.Once deleted here, it is gone from backups within 30 days.
The live combined report: Where your two surveys meet. Needs both to exist.Kept: Not stored. It is drawn from both of your surveys each time it is shown, so it ends the moment either survey does.If you withdraw: Withdrawn from the service for both of you.
A frozen combined report: The copy fixed at the moment of signing — each partner holds their own.Kept: Your copy is kept until you delete your account; your partner’s until they delete theirs.If you withdraw: Your own copy is deleted; your partner keeps theirs. Neither of you can delete the other’s.Once deleted here, it is gone from backups within 30 days.
The live agreement: The agreement text you are currently maintaining together.Kept: Your words are destroyed when you delete your account. The agreement itself is kept while either of you has an account. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Tombstoned — irreversibly — with the frozen signed copies retained per partner.Once deleted here, it is gone from backups within 30 days.
Your contributions to the agreement draft: What each of you wrote into each section, the clauses you added and the vows you wrote — stored separately, with who wrote what.Kept: Your words are destroyed when you delete your account. The agreement itself is kept while either of you has an account. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Your words are destroyed irreversibly; the record that you wrote something, and where, remains so your partner’s document stays honest.Once deleted here, it is gone from backups within 30 days.
The agreement’s version history: Every saved edit of every section — the full text at that point, with who saved it and when. This is what The Log renders.Kept: Your words are destroyed when you delete your account. The agreement itself is kept while either of you has an account. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Your versions’ content is destroyed irreversibly; that an edit was made, by which seat and when, remains — a history that can be quietly rewritten is not a history.Once deleted here, it is gone from backups within 30 days.
Signed agreement copies: What you both signed, frozen word for word at signing.Kept: Your copy is kept until you delete your account, and then deleted; your partner’s until they delete theirs.If you withdraw: Your own copy is deleted; your partner keeps their copy of what was signed. Stated before anyone consents.Once deleted here, it is gone from backups within 30 days.
The amendment log: Every change to the agreement after signing, word by word, with who made it.Kept: Kept with the agreement while either of you has an account. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Retained with attribution, so the record of what changed stays honest.Once deleted here, it is gone from backups within 30 days.
Your own practice entries: Daily weather, your side of the ledger — things only you wrote.Kept: Until you delete your account; deleted at once then.If you withdraw: Deleted absolutely.Once deleted here, it is gone from backups within 30 days.
Shared practice records: Records you both wrote into.Kept: Yours until you delete your account; your partner’s until they delete theirs. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Your contributions are removed; your partner’s remain theirs.Once deleted here, it is gone from backups within 30 days.
Support records only you can see: Support and contingency material that never reaches your partner — the questions you prepare for a second opinion, and anything you write for yourself alone.Kept: Until you delete your account; deleted at once then.If you withdraw: Deleted absolutely, immediately.Once deleted here, it is gone from backups within 30 days.
The breach log and the mediation room: What the two of you agreed each tier of a breach means; every entry in the breach log — what happened, which tier, who raised it, and the repair recorded against it; and everything written in a mediation, which both of you read.Kept: Your entries until you delete your account; your partner’s until they delete theirs. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Your entries are removed — including from your partner’s view of the log, because there was never a second copy. Their entries remain theirs. A log entry your partner wrote and you answered keeps their words and loses yours: the repair you recorded is blanked, and that it was repaired and closed stays.Once deleted here, it is gone from backups within 30 days.
The audit trail: Account-level events — an invitation sent, a module unlocked. Never what you read or wrote.Kept: Kept while either of you has an account. It never records what you read or wrote. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Entries remain, attributed to your seat with your identity detached — an accountability record that empties on request protects nobody.Once deleted here, it is gone from backups within 30 days.
A structured reset: Which of the five phases you have reached, when each was completed, and any notes either of you wrote against a task. It is, in plain terms, a record that the relationship was in serious trouble and that you worked on it deliberately — including where the conclusion was to separate.Kept: Your notes until you delete your account. Which phases the two of you completed is joint, and stays for your partner. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.Both of you can see it: a reset is joint work and a private half of it would not be one.If you withdraw: The notes and acknowledgements you wrote are removed, and they go from your partner’s view too. The record of which phases the two of you completed is joint and remains for them.Once deleted here, it is gone from backups within 30 days.
Parting terms: What the two of you agreed across nine sections while separating — the home, money, possessions, pets, children, how you communicate, what you tell people, digital accounts and shared commitments — plus the conduct protocol. None of it carries legal force, and the module says so on every page and in every export.Kept: Your words until you delete your account; your partner’s until they delete theirs. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.This module does not appear in navigation until it is deliberately opened.If you withdraw: The words YOU wrote are removed. What your partner wrote stays, because it is theirs — and because the alternative would let one person leaving erase the other’s copy of an arrangement they are both still keeping to.Once deleted here, it is gone from backups within 30 days.
A time capsule: The title you gave it and the date it opens, in clear. The writing itself is encrypted in your browser with a passphrase we never receive — we hold bytes we cannot read, and we have no way to ask for the passphrase or to derive it.Kept: Until you delete it or your account.Before the open date we do not send the encrypted contents to anyone, including you.If you withdraw: Deleted. Unrecoverable by design: the passphrase was never ours, so there is nothing else for us to destroy — and if you lose it, the contents are gone permanently, including for us.Once deleted here, it is gone from backups within 30 days.
The vault register: What the document is, where it lives, who holds it, and the release condition — ALL IN CLEAR, so that it can be read when it is needed. That means we can read it too. Only the access notes are encrypted with your passphrase. No document is ever uploaded: this is a list of where things are, not a store.Kept: Until you remove the entry or delete your account.If you withdraw: The entries you added are removed, and their encrypted notes go with them. Your partner’s entries are theirs and stay.Once deleted here, it is gone from backups within 30 days.
Get help now: Nothing. No database write, no cookie, no log of any answer. Held by automated tests.Kept: Nothing is stored, so there is nothing to keep or delete.If you withdraw: Nothing to delete — nothing was ever stored.
A guide request: Your email address, the words you agreed to when you asked for the guide, the version of those words, and when. Nothing else — no name, no answers, no account.Deleted after 7 days, counted from the moment you ask for a guide, if you never confirm — the request is deleted.Kept: A confirmed address is kept until you ask us to delete it. If you unsubscribe, it is kept only so that nothing is sent to it again.If you withdraw: Deleted absolutely. Unsubscribing stops the email; asking for deletion removes the record itself, and you can do either.Once deleted here, it is gone from backups within 30 days.
An invitation sent to you: The email address someone invited, who invited them, and how far the invitation got — sent, opened, started, completed, accepted — with the time each of those first happened. No answers, and nothing about you beyond the address until you start.Deleted after 30 days, counted from the day the invitation is accepted or expires — the invitation and its record are deleted.Kept: Until the invitation is accepted or expires, and never longer than the couple it belongs to. The person invited can ask for it to be deleted at any time. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.If you withdraw: Deleted absolutely — including where you were invited and never signed up. You can ask for this even if you never had an account: it is your address in it.Once deleted here, it is gone from backups within 30 days.
How your answers changed over time: Each time you completed the questions: the date, the six scores, and the archetype they produced. Retaking after a fortnight keeps the previous measurement alongside the new one; retaking within a fortnight replaces it, because that is a correction rather than a change.Kept: Until you delete your account; the whole series then.Nothing here is ever shown to your partner — they are not told that you retook anything, and they never see a previous archetype of yours.If you withdraw: Deleted absolutely. The whole series goes, not just the latest one.Once deleted here, it is gone from backups within 30 days.
Your positions on the eight long-term questions: For each topic you answer: your position, how settled you consider it, and any note you add. Two of the eight — illness and incapacity, and end of life — mean this includes information about your health, which the law treats as a special category and which we hold on your explicit consent.Kept: Until you change them or delete your account.Your partner sees your position on any topic you have both answered — that comparison is what the module is for, and it is the reason a position here is not private to you.If you withdraw: Your positions are removed, and they go from your partner’s view at the same time, because there was never a second copy. Their own positions stay: they are theirs.Once deleted here, it is gone from backups within 30 days.
The record of who carried what: Each logged entry: who carried it, which category, how heavy, an optional description, and when. Either of you can log an entry about the other, so an entry you wrote may be about them, and an entry about you may have been written by them.Deleted after 12 months, counted from the day an entry is logged — the entry is deleted.Kept: The module reads the last ninety days. Older entries stop being counted, and each is deleted when its period ends, or with your account if that comes first.If you withdraw: The entries you WROTE are removed — including ones you wrote about your partner, which means they lose that record too. Entries they wrote about you stay, because those are their words. We would rather tell you that plainly than have you find it out afterwards.Once deleted here, it is gone from backups within 30 days.
A message you send us: Your name if you gave one, the email address you gave, what you wrote, and when it arrived. It is held in the mailbox it was sent to and in the delivery record of the email provider that carried it and the copy sent back to you — never in the product’s database. Nothing else is recorded about you: not your connection, not your browser.Deleted after 12 months, counted from the day the enquiry is closed — it is deleted from the mailbox. The email provider keeps its own delivery record for its own period.Kept: Until the enquiry is answered and closed, then for the period below. The message lives in a mailbox, not in the product, so this is our practice rather than something the product enforces.Sending a message creates no account and no marketing record.If you withdraw: Deleted from the mailbox on request, and the provider asked to purge its record. Write to us through the same page and say so; nothing else is needed.
Your absolutes: For each of the thirty-one things in Non-Negotiables: your position, how firmly you hold it, and when you last changed it. Neither of you sees the other’s until you have both finished — that is enforced when the page is built, not by hiding it on screen.Kept: Until you change them or delete your account; your partner’s until they delete theirs. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.Editing an item replaces your own answer; there is no history of what you thought before.If you withdraw: The positions YOU stated are removed, and they go from your partner’s view of the comparison too, because there was never a second copy. Their own positions stay: they are theirs. What is left is their list, not a comparison.Once deleted here, it is gone from backups within 30 days.
A route you are following: Which route the two of you started and when, and which of its steps each of you has marked as done. Nothing from inside the modules along the way: it records that you reached a step, never anything you wrote or answered there. Those are covered by their own rows above.Kept: Your steps until you delete your account. The route itself is joint, and stays while either of you has an account. When the last of you has deleted their account, what is left of the couple’s shared record is deleted 12 months later.You both see the same steps — a route is joint work, and a private half of one would not be a route.If you withdraw: The steps YOU marked done are removed, and they go from your partner’s view too, because there was never a second copy. The route itself is joint and stays for them.Once deleted here, it is gone from backups within 30 days.
Where you are signed in: One record for each place you are currently signed in: the kind of browser and device (“Chrome on macOS”), when the session started, and when it was last used. NO LOCATION OF ANY KIND — not a city, not a country, not the address your connection came from. We do not collect them, which means we cannot show them to you, and cannot hand them to anyone who asks. What identifies the device is a one-way hash of your browser’s own description of itself, salted with your account, so it cannot be matched against any other account’s.Deleted after 30 days, counted from the moment you sign in on that device — the session expires and the record is deleted — you sign in again, and a new one starts.Kept: While the session is live. Signing out deletes the record then and there.“Sign out everywhere else” deletes all of them but the one you are using. Your partner never sees any of this.If you withdraw: Deleted absolutely. No history of the devices you signed in from is kept behind them — there is no version of that record this product should be able to hold.Once deleted here, it is gone from backups within 30 days.
Your diary: The dates you add to the diary yourselves: a birthday, an anniversary, a standing arrangement, the time you have agreed for the Walkthrough. Each is a name you typed, a day, how often it comes round and, if you gave one, a time. A name like “Mum’s birthday” is kept as the words you typed and nothing more — we never make a record of the person it is about. Everything else the diary shows, like your review date or a time capsule opening, is read from where it already lives and is covered by its own row above.Deleted after 90 days, counted from the day a one-off date falls on — the entry is deleted. A date that repeats — a birthday, a standing arrangement — has no last day, so it stays until either of you removes it or the account goes.Kept: A date that comes round again has no end, so it stays until either of you removes it or the account goes.Only you see a date you add unless you choose to share it with your partner.If you withdraw: The dates YOU added are removed, including any Walkthrough time you proposed. The dates your partner added stay, because they wrote them.Once deleted here, it is gone from backups within 30 days.
A year pass you paid for: That a year pass was bought, which plan, when it started and ends, which seat paid, and any refund. Never a card number or bank detail: the payment itself is handled by our payment provider. Nothing is held here until paid plans open.Deleted after 6 years, counted from the day the year you paid for ends, or the day it was refunded — the record is deleted.Kept: Kept for six years whatever else happens, because the law requires a business to keep a record of every sale. Deleting your account does not delete it; it stops saying which of you paid.If you withdraw: The record stays, because the law requires it, but it stops saying which of you paid. Your partner’s access for the rest of the year is not affected.Once deleted here, it is gone from backups within 30 days.
Who may operate the service: Which of our own staff may operate the service, in which role, and when that was granted and revoked. Only our staff ever hold one; it is here because the rule that every kind of data is published applies to our own records too.Deleted after 6 years, counted from the day the grant was revoked — the grant is deleted.Kept: Kept for six years after the grant is revoked, because the log of what an operator did refers to it. Only our own staff hold one.If you withdraw: A grant is revoked, never deleted, because the log of what that operator did refers to it; it goes six years after revocation.Once deleted here, it is gone from backups within 30 days.
What our staff did to your account: Each action a member of our operations staff took on your account — a session revoked, an invitation withdrawn, an export or an erasure run — with who did it, when, and the reason they gave. It names your account by its id only. It never records what you wrote, and nobody on our staff can read that.Deleted after 6 years, counted from the day the action was taken — the entry is deleted.Kept: Kept for six years, so that what our staff did to an account can be checked afterwards. It names your account by its id only, never by your email address, and never records what you wrote. Deleting your account does not delete it.If you withdraw: Entries remain for six years, naming your account by its id with your identity detached: the record that an account was erased must outlive the erasure.Once deleted here, it is gone from backups within 30 days.
Sign-in and confirmation links: When we email you a link to sign in, or a link to confirm a new email address, we keep the address it went to and a one-way hash of the link, so that we can recognise it when you use it. We never keep the link itself.Deleted after 1 day, counted from the moment the link is sent — the link stops working, and its record is deleted by the next daily clean-up.Kept: Only while the link can still be used. A sign-in link works once and for 24 hours, a link to confirm a new email address for an hour, and using a link deletes it at once.If you withdraw: Nothing needs doing: a link stops working within a day and its record is deleted then, whatever else happens to your account.Once deleted here, it is gone from backups within 30 days.
Your answer about the pilot’s end: During the pilot only: whether you asked for your data to be carried into Terms of Us when the pilot ends, when you answered, and which version of the launch privacy notice you were asked under. If you asked, the exact words you agreed to are kept as a consent record, like the others on this page. Your partner is never told your answer.Kept: Until the pilot ends. The moment it ends, your answer is read and then deleted. Deleting your account deletes it at once.If you withdraw: Deleted absolutely. Without it, your data is deleted when the pilot ends, which is what happens to anyone who has not asked.Once deleted here, it is gone from backups within 30 days.

An honest note on your raw answers

Today your verbatim answers are kept while your account exists, so your survey could be re-scored if the scoring improves. Whether that is the right rule — discard on scoring, encrypt under a key only you hold, or keep them for a fixed re-scoring window — is an open question, and we would rather mark it than pretend it is settled.

The exact words you consented to, the version and the date are kept so we can show your consent was validly given — that is a duty Article 7(1) puts on us, not a choice. How long they must survive after an account is deleted is not yet fixed; until it is, they are kept with the account and the question is marked below.

The amendment log

The agreement’s change history is retained with attribution, because an agreement whose history can be quietly rewritten is not a record. Whether a departed partner’s name in that history should be pseudonymised after they leave is an open question — the log is built so that either answer can be applied.

The safeguarding flag

The product’s design includes a safety flag that, once written, must not be erasable by the ordinary deletion flow — a safeguarding record that vanishes on request protects nobody. Nothing writes that flag today, because its legal condition, purpose record and retention rule are not yet settled. It will not be switched on before they are.

Messages sent through the contact page

Writing to us is the one way a person who is not a user gives us personal data. The message is not stored by the product: it is forwarded to the mailbox we read and a copy is sent back to you, and those two emails are the whole record. An answered enquiry is deleted from the mailbox 12 months after it is closed. That is our practice rather than something the product can enforce, because the mailbox is not part of the product. On what lawful basis an unsolicited enquiry is processed at all is not yet settled, and is marked below rather than assumed.

When the couple record ends

Some of what the two of you build is joint: the agreement, its history, the audit trail, a route you ran together. While either of you has an account, it stays for the one who remains. When the last of you has deleted their account, nobody can reach it any more, so it is deleted 12 months later — the couple record and everything still attached to it, including any signed copy that was still being kept. The one exception is the record of a year pass that was paid for, which the law requires us to keep for its own period, and which by then no longer says who paid.

Leaving a couple without deleting your account

Leaving removes what you wrote in the shared workspace, by the same rules as deleting your account: your words go, and the facts your partner relies on stay — that a section was written, that a phase was completed, that an entry was repaired. Your own copy of anything you signed goes too. Your account stays, and so do your own answers and your survey.

Backups

The pilot database is hosted at Neon, London, whose backups follow a snapshot and point-in-time-recovery model. Neon keeps seven days of history for it (since 7 October 2026). Anything deleted from the live database is gone from that history within seven days today, and within 30 days at the latest — the figure every row above states, and the longest window we would set without changing this page first.

Questions, or a request about your own data: write to us.