Data Retention · Version 1.0 · October 21, 2026
Data retention & disposal
How long Manna keeps each kind of data, including data received from Plaid, and how it is securely disposed of when it is no longer needed.
Purpose and scope
This policy sets how long Manna keeps each category of data, including consumer data received from the Plaid API, and how that data is securely disposed of when it is no longer needed. It applies to all production systems (Supabase database, backups and logs; Plaid; the Manna app on users' devices) and to everyone with access to them. It supports Manna's obligations under applicable privacy laws, including the California Consumer Privacy Act, the Gramm-Leach-Bliley Act where it applies, and our agreement with Plaid.
Principles
- Minimize: collect only what a feature the user chose needs. Do not store files or images that are only needed for processing.
- Keep only as long as needed: data is kept to provide the service to an active account. When the purpose ends, the data is deleted.
- User control: users can export, correct and delete their data in the app at any time.
- Dispose securely: deletion is complete, covers copies and backups, and is verifiable.
Retention schedule
| Data | Retention | Disposal |
|---|---|---|
| Account details (name, email, household name, password hash) | While the account is open | Deleted immediately when the user deletes their account |
| Budget, transactions, bills, rules, notes | While the household has at least one member | Deleted with the household. A shared household stays with its remaining members. |
| Bank data from Plaid (accounts, balances, transactions) | While the account is open; new data stops when a bank is unlinked | Deleted with the household. When a bank is unlinked, its connection is removed at Plaid and its access token is deleted at once. |
| Plaid access tokens | Only while the bank connection is active | Removed from Plaid (item removal) and deleted from our database on unlink or account deletion |
| Uploaded statements, receipt and check photos | Not retained: processed in memory, then discarded | Never written to storage. Our processor (Anthropic) does not retain them. |
| Details read from receipts and invoices (store, date, total, line items); tags and stewardship history | While the household exists | Deleted with the transaction or the household |
| Voice questions | Not retained | Transcribed on the device; no audio is sent to or stored by Manna |
| Data on the user's device | Until sign-out, account deletion or app removal | Local copy cleared from the device on account deletion; erased by iOS when the app is removed |
| Database backups | Up to 7 days (rolling) | Overwritten automatically by the hosting provider |
| Application audit log | Life of the household | Deleted with the household |
| Server and authentication logs | Per provider plan, at most 90 days | Expired automatically by the provider |
| AI usage counters (counts only, no content) | While the account is open | Deleted with the account |
| Privacy and support emails | Up to 2 years after the request is resolved | Deleted from the mailbox |
Consumer deletion requests
- In the app: You → Your data → Delete account deletes the user's sign-in and every household where they are the only member, and removes those households' bank connections at Plaid. It takes effect immediately.
- By email ([email protected]): we verify the request comes from the account's email address, then complete it within 30 days and confirm it in writing.
- Deleted data drops out of rolling backups within 7 days. Backups are not restored to bring back deleted accounts.
Secure disposal methods
- Database records: permanently deleted through cascading deletes, so no orphaned child records remain.
- Bank connections: Plaid's item-removal API is called so Plaid stops collecting data, then the token is deleted.
- Backups and logs: expire on the provider's fixed rolling schedule.
- Storage media: our hosting providers (Supabase on AWS) sanitize decommissioned media to industry standards (NIST SP 800-88). We operate no physical storage.
- Devices: the app's local copy is encrypted and is cleared from the phone on account deletion. A work device is wiped (factory reset with encrypted disk) before it is reused or disposed of.
Legal holds
If a law, court order or active investigation requires us to keep specific data, the policy owner may suspend deletion of that data only. Each hold is documented and the data is deleted when the hold ends.
Enforcement and review
- Any release that changes account deletion is tested end to end before it ships: create an account, add data and a bank connection, delete the account, and confirm that no rows remain and the connection is removed at Plaid.
- Each quarter, the policy owner confirms that backup and log retention settings match this schedule and that no uploaded files have been stored. The result is recorded in the risk register.
- This policy is reviewed every year, and whenever a new data source or vendor is added or privacy laws change.
Questions: [email protected] · See also the Privacy Policy.