Data Retention Policy

EverJoy Data Retention Policy

Effective Date: July 1, 2026
Last Updated: July 2026
Version: 2026-07
Policy Version (Database): 2026-07
Entity: EverJoy Memory LLC d/b/a EverJoy

---

1. Purpose and Scope

This Data Retention Policy ("Policy") defines how long EverJoy retains personal information and the procedures for deletion, export, and portability. It applies to all data processed through The AI-Powered Student Growth Cloud, including:

• Parent and child profile data
• Memories and capture artifacts
• Consent records and audit logs
• School roster data
• Billing and transaction records

This Policy implements the retention periods seeded in data_retention_policies (migration 00023_consent_and_retention.sql) and erasure workflows in yearbox/src/lib/erasure/service.ts.

---

2. Retention Principles

EverJoy retains personal information only as long as necessary to:

1. Provide the Service to users
2. Comply with legal obligations
3. Resolve disputes and enforce agreements
4. Maintain security and audit trails

We minimize retention wherever possible and delete data upon verified request subject to legal exceptions.

---

3. Retention Schedule

3.1 Primary Retention Periods

Policy version: 2026-07 (stored in DATA_RETENTION_POLICY_VERSION)

3.2 Additional Retention Periods

3.3 Retention While Account Active

While a parent account is active, child profiles and memories are retained indefinitely (subject to the 7-year maximum from creation). Parents may delete individual items at any time.

3.4 Retention After Account Deletion

Upon verified account deletion:

1. 30-day cooling-off period — Account marked for deletion; user may cancel
2. After cooling-off — Child profiles, memories, and storage files deleted
3. Consent records — Retained with revoked_at timestamp (not hard-deleted)
4. Audit logs — Retained for 3 years; profile_id may be anonymized
5. Billing records — Retained per tax requirements

---

4. Deletion Workflows

4.1 Memory Deletion

Trigger: Parent deletes memory from inbox, timeline, or bulk deletion.

Process:

1. Verify ownership via owns_student() / family membership
2. Load memories.storage_path and thumbnail_path
3. Delete storage objects from buckets:
   • memories — primary file
   • capture-artifacts — if ingestion_source = school_scan
4. Delete memories row (cascades to AI jobs, reactions)
5. Write audit log: action: delete, table_name: memories

Implementation: eraseMemoryArtifact() in yearbox/src/lib/erasure/service.ts

4.2 Child Profile Deletion

Trigger: Parent requests child removal from Settings → Children → Delete.

Process:

1. Verify caller owns student
2. Write audit log: action: delete, table_name: students
3. Delete dependent rows:
   • memories where student_id = ?
   • parent_student_links where student_id = ?
   • student_label_preferences, roster claim if applicable
   • students row
4. Delete storage objects (profile photo, all memories)
5. Revoke student-scoped consent records (revoked_at = now())

Implementation: eraseChildProfile() in yearbox/src/lib/erasure/service.ts

4.3 Account Deletion

Trigger: Parent requests account deletion via Settings or support@myeverjoy.com.

Process:

1. Insert account_deletion_requests with requested_at, profile_id, status
2. Send email confirmation link
3. 30-day cooling-off period
4. On confirmation:
   • Cancel Stripe subscription
   • For each family student: run child profile deletion (§4.2)
   • Delete profiles and auth.users via Supabase Admin API
   • Retain consent records and audit logs per retention policy
   • Anonymize accepted_by_profile_id in consent records if required

Implementation: requestAccountDeletion() and executeAccountDeletion() in yearbox/src/lib/erasure/service.ts

Note: Parent-facing account deletion UI is planned; beta users may contact support for deletion requests.

4.4 School Roster Deletion

Trigger: School Agreement termination or District request.

Process:

1. Set roster_sharing_authorized = false
2. Delete student_roster rows for school within 90 days
3. Retain activation records (parent-child links) as parent-controlled data
4. Write audit log

4.5 Orphan Storage Cleanup

Scheduled job (weekly):

1. List storage objects in memories, capture-artifacts, student-photos older than 7 days
2. Compare against database references
3. Delete orphans after confidence threshold or admin review

Status: Spec documented; automation planned (scripts/cleanup-orphan-storage.ts).

---

5. Data Export and Portability

5.1 Right to Export

Parents may request export of personal information and Child Profile content in a commonly used, machine-readable format.

5.2 Export Scope

5.3 Export Process

1. Parent submits request to privacy@myeverjoy.com or via Settings (when available)
2. EverJoy verifies identity
3. Export generated within 45 days (CPRA requirement)
4. Secure download link provided (expires in 7 days)

Note: Self-service export API/UI is planned; current process is support-assisted.

5.4 Portability

Exported data is provided in formats suitable for transfer to another service:

• JSON for structured data
• Original file formats for media (JPEG, PNG, PDF)
• Standard metadata schemas

---

6. Consent Record Handling

6.1 Retention

Consent records are retained for 2,555 days (~7 years) for compliance demonstration.

6.2 No Hard Delete

Consent records are never hard-deleted. Upon revocation:

• revoked_at timestamp recorded
• Record retained for audit trail

6.3 Anonymization

Upon account deletion, accepted_by_profile_id may be anonymized (replaced with hash or null) while retaining consent event record.

---

7. Audit Log Retention

7.1 Retention Period

Audit logs retained for 1,095 days (~3 years).

7.2 Immutability

Audit logs are append-only:

• Database triggers prevent UPDATE and DELETE
• Integrity maintained for compliance audits

7.3 Purge

Automated purge of audit logs older than 3 years (planned cron job).

---

8. Legal Holds

EverJoy may retain data beyond standard periods when:

• Required by law, regulation, or legal process
• Subject to litigation hold
• Necessary for ongoing investigation

Users will be notified of legal holds where permitted.

---

9. School and District Data

9.1 Roster Data

Roster data uploaded by schools is retained:

• During School Agreement — Active retention
• After termination — Deleted within 90 days unless legal hold

9.2 Capture Artifacts

Capture artifacts are parent-controlled data, not school data. Retention follows child profile retention (§3.1), not school agreement termination.

9.3 Aggregated Reports

Aggregated, de-identified participation metrics may be retained indefinitely for business analytics.

---

10. Backup Retention

10.1 Database Backups

• Daily backups via Supabase
• Point-in-time recovery available
• Backups retained per Supabase policy (typically 7-30 days)

10.2 Backup Deletion

Deleted data may persist in backups until backup rotation. Backups are not restored except for disaster recovery.

---

11. User Rights Summary

---

12. Implementation Status

---

13. Policy Updates

When retention periods change:

1. Update data_retention_policies table
2. Bump policy_version and DATA_RETENTION_POLICY_VERSION
3. Notify users of material changes
4. Obtain counsel sign-off before implementation

Current version: 2026-07

---

14. Compliance Mapping

---

15. Contact

---

---

Schedule A: Complete Retention Matrix

---

Schedule B: Erasure API Reference

---

Schedule C: Export Format Specification

C.1 JSON Schema

{
  "export_version": "2026-07",
  "exported_at": "ISO8601 timestamp",
  "account": { "name", "email", "created_at" },
  "children": [{
    "profile": { "name", "grade", "school", ... },
    "memories": [{
      "id", "title", "description", "created_at",
      "files": ["original paths"],
      "ai_metadata": { "summary", "classification", ... }
    }],
    "yearbooks": [...],
    "consents": [...]
  }]
}

C.2 File Delivery

• Export delivered as ZIP archive
• JSON metadata + original media files
• Secure download link (7-day expiration)
• SHA-256 checksum provided

---

Data Retention Policy version 2026-07. Aligned with yearbox/docs/data-retention-erasure-plan.md and yearbox/src/lib/erasure/service.ts.