Data Retention & Deletion
Owner: Ivy, Founder, Koda Digital · Effective: 2026-09-03
1. What is stored, where, and for how long
| Data | Location | Retention | Deletion mechanism |
|---|---|---|---|
| Plaid access tokens (one per linked institution) | Firestore users/primary/plaid_tokens |
Until the institution is unlinked | POST /remove-item calls Plaid /item/remove (revoking the token at Plaid) then deletes the document |
| Link metadata (Item id, institution name, link date) | Firestore users/primary/accounts |
Until unlinked | Deleted by POST /remove-item |
| Cached Plaid responses (balances, transactions, liabilities, recurring) | Firestore users/primary/plaid_cache |
Served for 4–12 h; documents purged 7 days after fetch | Daily scheduled job snapshotNetWorth purges expired entries; unlinking purges that Item's entries immediately |
| Daily net-worth totals (assets, liabilities, net worth — no account detail) | Firestore users/primary/net_worth_history |
Indefinite (this is the product's history feature) | Deleted on full account deletion |
| Manual assets entered by the user | Firestore users/primary/manual_assets |
Until edited/removed by the user | User action / full deletion |
| Bank credentials | Never stored — entered only inside Plaid Link | — | — |
| On-device data | None persisted; screens are fetched on demand | — | Uninstalling the app removes everything local |
| Backend logs | Google Cloud Logging | 30 days (default) | Automatic |
Plaid's own retention of Item data is governed by Plaid's policies; revoking an Item via
/item/remove ends Koda's access.
2. Deletion procedures
- Unlink an institution:
POST /remove-item { item_id }— revokes at Plaid, deletes the token and all cached data for the Item. Exposed in the app's Accounts screen. - Full deletion (close the account): for every Item, unlink as above; then delete the
users/primarydocument tree and disable the daily snapshot. As the operator is the only user, this is performed by the operator on request to themselves; a self-service "Delete all my data" action will be added before any multi-user release. - Backups: Firestore is not exported or backed up elsewhere, so deletion is complete once the documents are removed.
3. Minimisation
Only fields needed for the product are stored. Transaction caches hold Plaid's transaction records for the requested window only; net-worth history keeps three totals per day, never account-level detail.