How removal works
Losing access, requesting removal and completing physical deletion are different events. Access can end before background processing removes a file. After removal from the active database, its encrypted daily backup copies expire within seven days. This does not establish the retention of separately stored photos, service-provider logs or safety evidence.
Retention periods
| Information | Retention |
|---|---|
| Draft letter (never sealed), relationship active | While the author keeps it |
| Draft letter after breakup or account deletion | 30 days |
| Sealed letter awaiting conditions | Until opened; indefinite |
| Opened letter | Indefinite keepsake for both partners |
| Mutually deleted letter | Access ends immediately; bodies and photo files enter their audited removal queues, subject to holds; content-free metadata (timestamps, terminal state) retained |
| Both partners' deletions finalized (orphans) | Inaccessible immediately; retained inaccessible 1 year; then deleted from active systems |
| Ordinary shared plans, planning notes, birthdays, memories and ordinary memory-photo bytes after both original accounts permanently complete deletion | Inaccessible for 1 year from the second original account's permanent finalization, then scoped removal |
| Letters of a surviving recipient | Kept; inactivity alone never deletes an account containing letters |
| Deceased user | No new access path is created; letters follow the normal rules above |
| Account (self-deleted) | 30-day recovery window (tombstoned immediately; originals only in a protected recovery copy) → finalization ends account access, scrubs identifying profile information and processes removal of credentials, sessions, photo, push tokens and never-sealed drafts; a minimized opaque authorship record may remain |
| Empty inactive account (no sealed/opened letters, no active relationship, no unresolved reports, no pending deletion request, no holds) | 24 months of continuous inactivity, after at least two warning emails |
| Age-assurance record | Life of the account: {eligibility confirmation, timestamp, verification method, Terms version}, no birthdate |
| Consent / disclosure-acceptance records | Life of the account, plus up to 2 years after account finalization as consent evidence (longer under a legal hold) |
| Abuse reports + preserved reported-content evidence | 1 year after case close; longer under legal hold / law-enforcement request / unresolved safety investigation / continuing dispute or appeal / security or fraud investigation |
| Support tickets (outside the product DB) | 2 years after the ticket closes (longer under a legal hold or open investigation) |
| Server-side audit events (content-free codes + ids) | 2 years, operational |
| Auth logs, IPs, session/refresh tokens | Supabase authentication request logs, which include IP addresses, are kept for 7 days. A sign-in session, including the IP address and device information recorded for it, and its refresh tokens are kept until you sign out of that session or your account is finalized |
| App-held push-token registrations | Until replaced or unregistered; app-held registrations are deleted at account finalization. |
| Database backups (encrypted, managed) | Rolling 7 days for encrypted daily database backups. Point-in-time recovery is not enabled. These backups exclude photo file contents. |
| Legal holds | Suspend destruction for the specific items under hold, for the duration of the hold, documented in the support/legal record |
Push registration and provider records
The app removes its own push registrations through revocation and account finalization. This does not establish deletion of Expo-held registration or installation mappings. Expo, which relays notifications, keeps its own registration and installation records and content-free delivery records under its own retention practices, which we do not control.
Exceptions and your partner's copy
A legal hold, required evidence preservation or an active safety, security or fraud investigation can extend retention for the specific information involved. A personal clear removes an eligible archived letter from your own view and access. It does not remove your partner's copy or count as mutual deletion.
Sealed letters remain subject to the limited exceptions in the Terms of Service. See the Privacy Policy for account deletion and the Safety Standards for reports.
Questions and requests
Contact privacy@theloveenvelope.net or support@theloveenvelope.net.
Your questions deserve a clear answer.
Contact us