How long data is kept
Retention of every kind of record Assetli stores, what happens when you delete something, and what still exists in backups afterwards.
Last updated: October 30, 2026
Retention periods below are taken from the database indexes and constants in the code on the date above. Where a period is not controlled by the application, the table says so.
Your content
| Data | Kept |
|---|---|
| Accounts, transactions, investments, properties, vehicles, valuables, budgets, goals, subscriptions, loans, utility readings | Until you delete the record, or your account |
| Uploaded files (documents, photos, receipts) | Until you delete them, or your account; the file is removed from object storage, not only unlinked |
| Statement attachments sent by email | Not stored; read in memory |
| Transactions waiting for approval (Email import) | The transactions are removed from the queue right after import. Unapproved, rejected and unprocessed batches are deleted after 14 days, the next time the queue is opened. A record of each imported message (sender, subject, attachment name, import result, and the closing balance if the statement had one) stays until you delete your account |
| In-app AI conversations | Until you delete them |
| Saved property checks | Until you delete them |
| Property checks run without an account | Not saved to any account; the result is cached for 7 days by a fingerprint of the listing text |
| Notifications | 30 days |
| Phone registration token for notifications (Android and iPhone apps) | Until you sign out in the app, turn notifications off on the phone or delete your account; after the app is uninstalled we delete it as soon as Firebase (Android) or Apple (iPhone) reports the token is no longer valid; a token not renewed for 270 days is deleted automatically |
| Saved calculator plans | Until you delete them |
Security and access records
| Data | Kept |
|---|---|
| Sign-in session (cookie) | 7 days from last use; Sign out of all devices ends it immediately (other server instances within 30 seconds) |
| OAuth access token (MCP, mobile) | 1 hour |
| OAuth refresh token | 60 days, replaced on every refresh; all tokens of a connector are revoked immediately when you remove it or use Sign out of all devices |
| OAuth authorisation code | 10 minutes, single use |
| Google Sheets add-on tokens | 1 hour access, 30 days refresh |
| MCP audit log (write calls only) | 365 days |
| Email verification link | 24 hours; the database keeps only a hash, and the link works once |
| Password reset link | 60 minutes; the database keeps only a hash, and the link works once |
| Password sign-in attempts (email, time, success or failure) | For the account lockout, failed attempts are counted within a 15-minute window; a lockout lasts 15 minutes. The record of an attempt is deleted automatically after 365 days |
| Rate-limit counters | 24 hours |
| Two-factor secret and backup codes | Until you disable two-factor authentication or delete the account |
| A record for one sign-in, no code (that you turned two-factor authentication on or off from it, or verified the code when entering the admin area) | 7 days |
| Known devices for the new sign-in e-mail (only a hash of device type, browser and operating system, no IP address) | 400 days from the last sign-in from that device; deleted immediately with the account |
| Signed link to an attached file | At most 15 minutes |
| Admin access log (who, when, path and the ID of the record opened, no content) | 365 days, then deleted automatically; deleting the account does not remove it |
Operational records
| Data | Kept |
|---|---|
| Database backup | Encrypted with AES-256, on the operator’s own computer in the Czech Republic, scheduled every night (since 22 October 2026 the nightly run has been failing and we are fixing it). Backups older than 30 days are deleted; the last 7 backups are always kept, even if they are older. A second encrypted copy is kept 30 days as a GitHub Actions artifact, only when the job runs there (it has not run since 21 October 2026) |
| Copy of an emailed statement message (Email import) | 30 days at Resend; Resend does not allow earlier deletion |
| Log of sent emails (type of email, time, delivery status, shortened address, subject without amounts; never the message text) | 400 days, then deleted automatically; immediately when you delete your account |
| Undeliverable address or spam complaint (hash of the address and the reason) | Until you change your email address or delete your account |
| Consent log (automatic import, spending AI credit, AI in the mobile app, tips by email, unsubscribing via an email link) | For the life of the account |
| Record of tips by email (which were sent, whether you clicked) | For the life of the account |
| Anonymous statistics on statements the import did not recognise (column names and separator only, no link to an account) | 2 years after the last occurrence |
| Anonymised statement samples you choose to send from the mapping wizard (no link to an account) | 1 year |
| Hosting request logs and function output (Vercel) | Per the Vercel plan; not controlled by the application |
| Error logs from the web and the mobile apps for Android and iPhone (error message and stack trace, page or screen, app and system version, account ID as a pseudonym, IP address, user agent) | 12 months, then deleted automatically. Entries linked to your account are deleted with the account. |
| Anonymous tap counts from the More screen of the mobile app for Android and iPhone (daily totals per item, no link to an account) | Not limited; they contain no personal data |
| Monthly AI budget | Renews one month after registration or after the subscription payment, every month; topped-up and lifetime credit stays until you spend it or delete the account |
| Payment records (invoices, payments) | Kept by Stripe; as accounting and tax documents they are retained for the period required by Czech accounting and tax law. They do not remain in the Assetli database after account deletion. |
Deleting your account
Settings → Delete account (on the web, or in the mobile app for Android and iPhone under More → Settings) removes, in one operation: the user record, every profile, and every record keyed to you in every collection, including records owned through a shared-expense group or a Family Legacy contact, records of sign-in attempts keyed to your email, and every file in object storage. The confirmation phrase is required.
An active Stripe subscription is cancelled on deletion and your Stripe customer record is deleted. In shared-expense groups owned by someone else, your member entry is anonymised: the name, email, bank details and the link to your account are removed, while the amounts stay so the other members’ settlements still add up. Your contact entry is removed from other people’s Family Legacy plans.
Two things survive that deletion for a limited time and are outside our live database:
- Backups. A backup taken before the deletion still contains your data until it is deleted — usually within 30 days, but the last 7 backups are always kept, even if they are older. Backups are encrypted and used only to restore the whole database after a failure.
- Payment records (invoices, payments) at Stripe, retained as accounting and tax documents for the period required by Czech accounting and tax law. They do not remain in the Assetli database.
Emails already sent cannot be recalled from Resend or from your inbox.
Likewise, Resend keeps its copy of messages sent for Email import for up to 30 days after receipt.
We also keep a short deletion record: the internal ID of the deleted account, the e-mail address in masked form, a SHA-256 hash of the e-mail address, the time and technical details of the deletion (such as the number of deleted records). It proves that the request was fulfilled and lets us delete the account again if the database ever has to be restored from a backup. It contains no financial data. It is kept for 3 years from the deletion and then deleted automatically.
If the operator opened your account in the admin area, a record of that access also remains (who, when and the account ID, no content) — for 365 days from the access, then it is deleted automatically. Deleting the account deliberately does not remove it, so that the trace of the access cannot be erased.
Exporting your data
Settings → Export data produces a file with every record you own across all collections, excluding authentication secrets and transient logs. You can export as often as you like.