Data Retention Policy
Last updated: October 1, 2026
This policy expands on Section 6 of our Privacy Policy and is not a separate legal agreement — it describes, in more operational detail, how long different categories of data are kept and why.
Retention by data category
| Data category | Retained while | After account/business termination |
|---|---|---|
| Business operational data (products, inventory, orders, suppliers, expenses, store settings) | Active use of the App | Deleted within 90 days, or immediately upon request |
| Staff account data (username, name, email, role) | Account is active | Deleted within 90 days, or immediately upon request |
| Device-lock data (device ID, device name) | Associated account is active | Deleted with the account |
| Push notification tokens | Device is registered / notifications enabled | Deleted when the account is deleted, or automatically expired by Apple/Google if the token becomes invalid |
| Uploaded product images | Product exists in the App | Deleted with the associated product, or within 90 days of account termination |
| Subscription payment records (amount, date and order reference received from Flitt) | While the subscription is active | Kept for as long as accounting and tax record-keeping rules require, then deleted |
| Crash/error reports (Sentry) | N/A — event-based, not tied to account lifecycle | Retained per Sentry's standard window (currently ~90 days), independent of your account status |
| Analytics events (PostHog) | N/A — event-based | Retained per PostHog's standard window; may be retained longer in aggregated/anonymized form for product-improvement purposes |
Why these periods
- 90-day post-termination window for account and business data: gives a reasonable grace period for accidental cancellations or account-recovery requests, while not retaining data indefinitely once it's no longer needed.
- Immediate deletion on request: honors your right to erasure (Privacy Policy, Section 7) without making you wait out the default window if you don't want to.
- Crash and analytics data are decoupled from account lifecycle because, once the identifying link to your account is removed, this data no longer identifies your business and is used only in aggregate to improve the product.
Legal or operational exceptions
We may retain specific records longer than the periods above where required by law (for example, financial or tax record-keeping obligations that apply independently of COFOS), or where necessary to resolve a dispute, enforce our agreements, or investigate suspected abuse. Any such extended retention is limited to what's necessary for that specific purpose.
Backups
Standard database backups maintained by our infrastructure provider (Supabase) may retain deleted data for a limited additional period as part of normal disaster-recovery processes, before being purged in the ordinary backup rotation cycle. This is not a mechanism for us to retain your data beyond the stated policy — it is a standard operational safeguard against accidental data loss.
Contact
Questions about this policy, or a request to delete or export your data ahead of the default schedule: info@getcofos.com