| Temporary personal web-export copies and one-use delivery state | At most 15 minutes of access; keys removed immediately on completion or revocation; encrypted copies removed later in bounded cleanup batches | per-export key disposal on completion, failure, logout, erasure or restore; expiry checks and bounded cleanup |
|---|
| Website access logs (time, path template, status, duration, random request ID; no addresses or content) | 14 days, earlier when the storage budget is full; a stopped web server's logs are deleted by a daily task, up to one day later | pruning by the web server at its start and every minute; for a stopped web server the daily task -PruneLogs |
|---|
| Website event log (server errors by page and error type, missing texts, failures and refusals between the website and Defendr, failed sign-ins by reason, counts of access-log records dropped, and of access-log files deleted early with the minute their records start; no person, address, URL, cookie, content or session) | 14 days, earlier beyond 4 MiB (the oldest first); a stopped web server's log is deleted by a daily task, up to one day later | pruning by the web server at its start and every minute; for a stopped web server the daily task -PruneLogs |
|---|
| Website tunnel log on our server (cloudflared): only errors that stop the connector itself (log level fatal) and warnings about its own connection to Cloudflare (transport log level warn); no requests, requested addresses or IP addresses of visitors | no automatic deletion after a fixed period yet | manual deletion by the operator |
|---|
| E-mails to the @defendr.live addresses (contact@, privacy@, security@, including vulnerability reports; Gmail mailbox) | deleted once no longer needed for the request, at the latest three years after the request is closed, unless a legal duty requires longer | manual deletion in the mailbox |
|---|
| Website sessions and encrypted OAuth access tokens | 7 days without activity; at most 30 days | logout, erasure/restore invalidation and retention.purge |
|---|
| Website security events (sign-in, sign-out, sign out everywhere, ending one other session, a sign-in Defendr undid after Discord had confirmed it; device category and time; no addresses) | 365 days | retention.purge; erasure |
|---|
| Receipts of website actions (route, state, result code, times; the request and its idempotency key only as hashes) | 365 days after the action finished | retention.purge; erasure; guilds.purge for server actions |
|---|
| Website and account preferences (language, whether Defendr messages follow it, inbox read marker, theme, accent, density, motion) | until the account data is deleted (no time limit); removed on request | erasure |
|---|
| Security score history per server (weekly score and part scores, no user IDs) | indefinite (aggregates); with the server's data after Defendr leaves | guilds.purge |
|---|
| Message content during scanning | Seconds (memory only) | not stored |
|---|
| Detection records (ids, type, action; no message content) | 1825 days | retention.purge |
|---|
| Moderation cases (+ events) | 1825 days (owner-set, identical in every server) | retention.purge |
|---|
| Message excerpts (opt-in per server) | at most 1095 days, never longer than the case | purge (sealed; crypto-shredding) |
|---|
| Uploaded evidence (staff uploads on Safety Records and cases) | 1095 days; record evidence with the record; legal hold suspends deletion; nothing a member attaches is stored | purge + file unlink (crypto-shredding) |
|---|
| Reports and co-reporter links | accepted: 1825 days after decision; rejected/spam: 365 days; pending: auto-closed after 90 days | purge |
|---|
| Reporter reputation | 1825 days after last report | purge |
|---|
| False-positive signals (moderator id, case) | 1095 days | purge |
|---|
| Review votes and staff threads | with the reviewed item | purge (+ thread deletion) |
|---|
| Appeals (incl. recommendations) | 1825 days after decision or lapse | purge |
|---|
| Support tickets (form text sealed; the private thread in the support server) and ticket bans | 1825 days after closing (row and thread); a ticket thread left without its record (after a failed creation or a restore from a backup) is deleted 1825 days after it was created (possibly locked and archived before then) — because no record links it to a member, the team deletes it by hand on an erasure request; ticket bans until lifted | support.tickets (thread first, then the row; a thread without a record by the list of the job, kv.support.orphans); a ban is deleted when lifted |
|---|
| Direct-message conversations with Defendr (user ID, the post in the staff channel, time of the last message, muted or not; never the text) | 1825 days after the last message; within an hour of an erasure | ops.dm-chats (the post first, then the row) |
|---|
| Data subject requests; processing restrictions | 1825 days (accountability; content minimized and sealed); restrictions 1825 days after lifting | purge |
|---|
| Active network listing | no automatic expiry; re-review reminder after 12 months (a status change always needs a staff decision) | re-review reminder + purge 1095 days after close |
|---|
| Quarantined imported listings (811 + 4) | until reviewed; reminder after 6 months (OD-7) | review decision |
|---|
| Closed Safety Records (revoked/rejected/expired) | 1095 days | purge |
|---|
| Member flags: hijacked account / raid cohort / network hint shown | 72 hours / 7 days / 30 days | member-flags.expire |
|---|
| Member flag: pending verification | at least 24 hours, as long as the server's kick-unverified delay + 1 hour | member-flags.expire |
|---|
| Member flags: join-gate quarantine role / suspect role applied by Defendr | while the role is held; 30 days after leaving | reconcile jobs + member-flags.expire |
|---|
| Raid cohorts (metadata only) | 365 days | purge |
|---|
| Incidents | 1825 days | purge |
|---|
| Anti-nuke role strips / structure snapshots / deleted entities (2.1) | 30 / 7 / 14 days | purge |
|---|
| Lockdown records | 1095 days after end | purge |
|---|
| Verification challenges | 24 hours | purge |
|---|
| Interactive UI state (sealed) | ≤ 24 hours | ui_state.purge |
|---|
| Pending messages (outbox) | content wiped when sent or given up; rows 7 days (sent) / 30 days (failed) | purge |
|---|
| Config revisions; preset and migration card decisions | last 100, max 1 year; decisions 90 days | purge |
|---|
Audit log (ops_audit): staff access incl. evidence views, and each website action (user ID, action, server, time, outcome, receipt and request ID) | 1825 days; kept on erasure (accountability) | purge |
|---|
| Staff membership | 1825 days after deactivation | purge |
|---|
| Anonymous network signals (2.1) | 48 hours | purge |
|---|
| Premium entitlements (2.2) | 30 days after end | purge |
|---|
| Application logs (no content) | 90 days | rotation |
|---|
| Global mirror (#global-logs, staff channel): ids, action and event types, counts and times of Defendr's actions and of the moderation, report and appeal events handled through it (moderator and staff ids included), the names Discord showed for the server, the channel, the member and the moderator or staff member at that moment, and the listed threat value a link or invite Defendr detected matched; never message content | kept until the operator deletes it (owner-set retention, decision of 2026-09) | operator (Discord channel) |
|---|
| Error events (redacted) | 365 days | purge |
|---|
| Statistics aggregates (no user IDs): counts per day, server and metric, incl. per reason code and per detection family | indefinite | — |
|---|
| Setup answer "Where did you find Defendr?" (per server, optional; not assigned to a person) | with the server's configuration: 90 days after Defendr leaves (or immediately if configured) | guilds.purge |
|---|
| All guild data after Defendr leaves | 90 days (or immediately if configured); cancelled by re-invite | guilds.purge |
|---|
| Local backups | 14 daily / 8 weekly / 6 monthly | prune |
|---|
| Offsite backups (encrypted) | 14 daily / 8 weekly / 12 monthly | restic forget/prune |
|---|
| v1 history dossiers | not migrated; destroyed at v1 decommission (T+30 d, encrypted archive destroyed after 90 d) | owner runbook |
|---|