Legal
Data retention
How long Codexa keeps each kind of data and what deletion does. Draft pending legal review.
Last revised
Retention schedule
| Data | Kept while | After deletion |
|---|---|---|
| Account (email, name, password hash) | Your account exists | Removed within 30 days of account deletion; audit entries keep a pseudonymous id |
| Sessions | Until sign-out or expiry | Removed on expiry |
| Projects, files, snapshots | The project exists | Removed within 30 days of project deletion |
| Environment variables and integration secrets | The project or connection exists | Removed with the project or connection |
| AI conversations and runs | The project exists | Removed with the project |
| Deployment records and build logs | The project exists | Removed with the project; published builds are taken down at deletion |
| Usage events | Current and previous 12 billing periods | Aggregated for billing records |
| Invoices and subscription records | 7 years or as required by tax law | Retained as required |
| Audit logs | 12 months | Removed after 12 months unless needed for an investigation |
| Support tickets | 24 months after closure | Removed |
| Newsletter subscription | Until you unsubscribe | Email retained on a suppression list to honour the unsubscribe |
| Rate-limit counters and runner logs | Hours to days | Rolled over automatically |
Backups
Database backups are managed by the operator's PostgreSQL hosting. Deleted data may persist in backups for the backup retention window before it is overwritten.
Requests
To request deletion or export beyond what the product offers, email privacy@codexa.app.