Data Retention & Deletion
Owner: Ivy, Founder, Koda Digital · Effective: 2026-09-03
1. What is stored, where, and for how long
| Data | Location | Retention | Deletion mechanism |
|---|---|---|---|
| Plaid access tokens (one per linked institution) | Firestore users/primary/plaid_tokens |
Until the institution is unlinked | POST /remove-item calls Plaid /item/remove (revoking the token at Plaid) then deletes the document |
| Link metadata (Item id, institution name, link date) | Firestore users/primary/accounts |
Until unlinked | Deleted by POST /remove-item |
| Cached Plaid responses (balances, liabilities, recurring) | Firestore users/primary/plaid_cache |
Served for 4–12 h; documents purged 7 days after fetch | Daily scheduled job snapshotNetWorth purges expired entries; unlinking purges that Item's entries immediately |
| Transaction ledger (date, amount, merchant, category, account/institution) | Firestore users/primary/transactions |
Indefinite — these are the user's own financial records and the basis of the history features | Retained when an institution is unlinked (see §2); removed on full account deletion. Exportable at any time via GET /export-transactions?format=csv |
| Daily net-worth totals (assets, liabilities, net worth — no account detail) | Firestore users/primary/net_worth_history |
Indefinite (this is the product's history feature) | Deleted on full account deletion |
| Manual assets entered by the user | Firestore users/primary/manual_assets |
Until edited/removed by the user | User action / full deletion |
| Bank credentials | Never stored — entered only inside Plaid Link | — | — |
| On-device data | None persisted; screens are fetched on demand | — | Uninstalling the app removes everything local |
| Backend logs | Google Cloud Logging | 30 days (default) | Automatic |
Plaid's own retention of Item data is governed by Plaid's policies; revoking an Item via
/item/remove ends Koda's access.
2. Deletion procedures
- Unlink an institution:
POST /remove-item { item_id }— revokes at Plaid, deletes the token and all cached data for the Item. Exposed in the app's Accounts screen. Ledger rows are deliberately kept, so spending history survives disconnecting or re-linking a bank; they retain the institution name they were recorded under. Use full deletion to remove them. - Full deletion (close the account): for every Item, unlink as above; then delete the
users/primarydocument tree — including the transaction ledger — and disable the daily snapshot. As the operator is the only user, this is performed by the operator on request to themselves; a self-service "Delete all my data" action will be added before any multi-user release. - Backups: Firestore is not exported or backed up elsewhere, so deletion is complete once the documents are removed.
3. Minimisation
Only fields needed for the product are stored. The transaction ledger keeps the fields the Activity, Trends, and Bills screens display plus the identifiers needed to reconcile updates from Plaid; of Plaid's location data only city and region are kept, never street address or coordinates. Net-worth history keeps three totals per day, never account-level detail.