Data Retention Policy

This app exists partly to be a credible evidence record. A retention policy that quietly deleted or altered data would undermine that purpose as surely as a policy that kept everything forever would raise privacy concerns. The approach taken is: keep what has evidential significance indefinitely and unaltered, be transparent about what that includes, and give people real control over everything else. Nothing in the app silently expires or is silently rewritten — every deletion is either a deliberate, visible action by the person entitled to take it, or a scheduled process disclosed here.

• Diary entries, sleep, food, communication and medication records. Kept indefinitely once created. An entry can be freely edited within its first 24 hours; after that, or once it has been digitally signed, further changes are made through a visible Amendment that records what changed and preserves the original wording — the original is never overwritten or removed. A system-side correction to a stored value (for example, a timezone-calculation fix) is recorded separately again, as an EntryCorrection, distinct from an Amendment, because it represents the software correcting its own error rather than the parent revising their account.
• Audit logs. Kept indefinitely. This is the technical record of who did what and when — account creation, logins, entry creation/editing/signing, deletions, access grants and revocations, and disclosure decisions such as changing who a sleep record is visible to. It exists specifically so the chronology itself can be checked, which requires it not to be pruned.
• Media (photos, video, audio, documents). Kept for as long as the entry or record it is attached to exists, with original file metadata intact.
• AI-generated insights, Ask Moo conversations, and meta-analysis reports. Kept indefinitely as part of the record, on the same basis as diary content — an insight report is itself a dated record of what the app concluded from the data available at the time, and deleting it would remove part of the history rather than tidy it.
• Notifications. Kept as part of the record of what was surfaced to whom and when, though the “read” state of a notification is naturally viewer-specific.
• Session and login data. A session is treated as stale and revoked automatically after 30 days of inactivity; the record that a session existed and was revoked is retained as part of the security audit trail described above.
• Billing and subscription records. Kept for as long as required for accounting and tax purposes after the relationship ends, consistent with normal UK record-keeping obligations for financial records.

Nothing is deleted. Cancelling a paid subscription moves a family to Lite-equivalent access. Every entry, record, insight, and export a family has already created remains fully intact and readable — the features that stop are the ones gated behind a paid tier (Ask Moo, WhatsApp reminders, AI letter/report generation, EHCP intelligence features, and evidence bundle export), and reading your own existing data is never one of the things a downgrade restricts. The same applies where a payment fails and the 14-day grace period lapses without a successful payment.

A person can delete their own account from Settings by typing a confirmation phrase. This:

• Disables the account immediately — login is blocked from that point.
• Schedules the account for permanent removal 90 days later, giving a window to change your mind or resolve an accidental deletion.
• Notifies the family that the account was deleted.
• Does not destroy the entries that person authored. An entry someone wrote remains part of the family's diary and evidential record after their own account is gone, for the same reason a diary written by hand doesn't disappear if the person who wrote it moves away — the record belongs to the child's ongoing history, not solely to the account that created it, and may in any case be under legal hold (see below).

There is currently no automatic process that deletes a family's data purely for inactivity. If a family wishes their account and data fully removed, this is handled as a manual request to us (see Contact below), subject to the legal hold exception below and to our own obligation to keep certain records (billing, audit) for the periods described above. If the app itself is ever permanently discontinued, data will be made available for export and then securely deleted within 30 days of that discontinuation being announced.

Where an entry, record, or export has been submitted to or referenced in family court or other legal proceedings, it may be subject to a legal hold: an obligation to preserve it that overrides an ordinary deletion request until the hold is lifted (typically when the relevant proceedings conclude, or on confirmation from the party who requested the hold that it is no longer needed). This is the same reason signed entries and entries older than 24 hours cannot be silently edited in the first place — the two protections exist for the same underlying purpose.

The database is backed up on a daily automated schedule. Uploaded media (photos, videos, audio, documents) is separately mirrored to backup storage on a weekly schedule. Backups exist to recover from an operational failure — a lost server, a corrupted deployment — not as a second, independent copy of data a family has asked to have deleted; a genuine deletion request is expected to be honoured in the live system and to age out of backup retention in the ordinary backup rotation rather than requiring a separate purge of every historical backup.

A professional's access grant to a child is retained as an auditable record even after it is revoked — the fact that access existed and was later withdrawn is itself part of the record, rather than something that disappears once access ends. Revocation itself takes effect immediately for read/write purposes; only the historical record of the grant having existed is retained.

An institution's credit and usage ledger (top-ups, per-query charges, invoices) is append-only and retained in full for the same reason an audit log is: it is what makes the institution's balance provable rather than merely asserted, and is also required for ordinary financial record-keeping.

To request an export, a correction, or deletion of data not covered automatically above, contact: donnie.eastwood@icloud.com

See also: Privacy Policy, Terms of Service, and the Safeguarding Statement.