DATA RETENTION POLICY
Effective Date: 04/02/2026 | Version 1.1 | Last Updated: 09/27/2026
1. Purpose
This Data Retention Policy establishes the specific purposes, business needs, timelines, and methods for retaining and deleting personal information collected by RegulateMe, as required by the Children's Online Privacy Protection Act (COPPA), 16 CFR ยง 312.10, as amended April 22, 2025.
2. Data Retention Schedule
Minimized, non-identifying deletion completion evidence contains only an opaque event reference, deletion method, subject count, outcome, completion time, and expiry time. It is retained for no more than 90 days and automatically purged by a daily retention job. Separately, the parent delivery email is encrypted in a restricted completion queue only until provider acceptance is confirmed and recorded, with an automatic 7-day maximum. That queue never contains child data.
Child name/nickname
- Purpose
- Display in app interface
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
Goal completions, streaks, points
- Purpose
- Track daily progress and habits
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
Mood scores and context tags
- Purpose
- Mood tracking and parent reports
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
ABC behavior logs
- Purpose
- Parent-entered Antecedent-Behavior-Consequence notes for understanding patterns around hard moments
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
Reward redemptions and vouchers
- Purpose
- Reward economy and motivation
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
Sensory/cool-down activity usage
- Purpose
- Track regulation tool usage
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
Goal suggestions and custom text
- Purpose
- Store child-submitted goal ideas
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
In-app preferences (avatar, theme, settings)
- Purpose
- Personalize child experience
- Retention
- Until parent deletes, revokes consent, or 60-day inactivity
- Deletion
- Cascading database delete
Drawings
- Purpose
- Creative expression activity
- Retention
- Stored locally on device only; never uploaded
- Deletion
- Cleared when user clears browser data
Feelings Journal entries
- Purpose
- Child reflection during cool-down activities
- Retention
- Current entries are stored locally on this device; older server-synced rows, if present, follow child-data retention
- Deletion
- Successful in-app child-data deletion or consent revocation clears local entries on that device; copies on other devices and local copies after server-side 60-day cleanup must be cleared on those devices. Older server-synced rows delete through account child-data controls
Parent email address
- Purpose
- Account authentication, notifications, consent verification
- Retention
- Until account deletion, except the encrypted completion-delivery copy listed below
- Deletion
- Account deletion removes the account copy; the restricted delivery copy is deleted once provider acceptance is recorded or within 7 days
Parent display name
- Purpose
- Account identification
- Retention
- Until account deletion
- Deletion
- Account deletion
Parent PIN (hashed)
- Purpose
- Secure parent mode access
- Retention
- Until changed or account deleted
- Deletion
- Overwritten on change; deleted on account deletion
Billing provider customer ID and subscription status
- Purpose
- Payment processing, subscription entitlement, and receipt status through Stripe, Apple App Store, Google Play, and RevenueCat using parent billing identifiers only; no child activity data
- Retention
- Until account deletion
- Deletion
- Account deletion; billing providers retain records per their policies
Account deletion requests
- Purpose
- Track and fulfill account deletion requests
- Retention
- Until the request is completed
- Deletion
- Request details are removed after fulfillment; the encrypted delivery queue and non-identifying evidence follow their separate schedules below
Encrypted completion-email delivery address
- Purpose
- Send or retry the promised account-deletion confirmation without retaining child data
- Retention
- Until provider acceptance is confirmed and recorded, with a hard maximum of 7 days after deletion
- Deletion
- Deleted once provider acceptance is recorded; otherwise automatically purged at the 7-day maximum
Consent records (action, timestamp, IP, user agent, consent text)
- Purpose
- Document and manage parental consent, revocation and expiry
- Retention
- While the parent account exists
- Deletion
- Full account deletion removes the complete consent records, including IP addresses and browser information; child-data deletion alone preserves the parent account and consent history
Operational request logs (including IP-derived approximate location, timing and diagnostics)
- Purpose
- Security, troubleshooting and service performance
- Retention
- 7 days under our current Supabase plan
- Deletion
- Expires through the provider's operational-log retention controls; no external log drains are configured
Minimized deletion completion evidence
- Purpose
- Confirm that a deletion completed without retaining child or account identifiers
- Retention
- Up to 90 days after completion
- Deletion
- Automatically purged by a daily retention job
| Data Category | Purpose | Retention Period | Deletion Method |
|---|---|---|---|
| Child name/nickname | Display in app interface | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| Goal completions, streaks, points | Track daily progress and habits | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| Mood scores and context tags | Mood tracking and parent reports | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| ABC behavior logs | Parent-entered Antecedent-Behavior-Consequence notes for understanding patterns around hard moments | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| Reward redemptions and vouchers | Reward economy and motivation | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| Sensory/cool-down activity usage | Track regulation tool usage | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| Goal suggestions and custom text | Store child-submitted goal ideas | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| In-app preferences (avatar, theme, settings) | Personalize child experience | Until parent deletes, revokes consent, or 60-day inactivity | Cascading database delete |
| Drawings | Creative expression activity | Stored locally on device only; never uploaded | Cleared when user clears browser data |
| Feelings Journal entries | Child reflection during cool-down activities | Current entries are stored locally on this device; older server-synced rows, if present, follow child-data retention | Successful in-app child-data deletion or consent revocation clears local entries on that device; copies on other devices and local copies after server-side 60-day cleanup must be cleared on those devices. Older server-synced rows delete through account child-data controls |
| Parent email address | Account authentication, notifications, consent verification | Until account deletion, except the encrypted completion-delivery copy listed below | Account deletion removes the account copy; the restricted delivery copy is deleted once provider acceptance is recorded or within 7 days |
| Parent display name | Account identification | Until account deletion | Account deletion |
| Parent PIN (hashed) | Secure parent mode access | Until changed or account deleted | Overwritten on change; deleted on account deletion |
| Billing provider customer ID and subscription status | Payment processing, subscription entitlement, and receipt status through Stripe, Apple App Store, Google Play, and RevenueCat using parent billing identifiers only; no child activity data | Until account deletion | Account deletion; billing providers retain records per their policies |
| Account deletion requests | Track and fulfill account deletion requests | Until the request is completed | Request details are removed after fulfillment; the encrypted delivery queue and non-identifying evidence follow their separate schedules below |
| Encrypted completion-email delivery address | Send or retry the promised account-deletion confirmation without retaining child data | Until provider acceptance is confirmed and recorded, with a hard maximum of 7 days after deletion | Deleted once provider acceptance is recorded; otherwise automatically purged at the 7-day maximum |
| Consent records (action, timestamp, IP, user agent, consent text) | Document and manage parental consent, revocation and expiry | While the parent account exists | Full account deletion removes the complete consent records, including IP addresses and browser information; child-data deletion alone preserves the parent account and consent history |
| Operational request logs (including IP-derived approximate location, timing and diagnostics) | Security, troubleshooting and service performance | 7 days under our current Supabase plan | Expires through the provider's operational-log retention controls; no external log drains are configured |
| Minimized deletion completion evidence | Confirm that a deletion completed without retaining child or account identifiers | Up to 90 days after completion | Automatically purged by a daily retention job |
3. Deletion Triggers
Child data stored in the RegulateMe account is deleted under any of the following conditions:
- Parent-initiated deletion: Parent deletes a child from Privacy & Data in Parent Settings. Active child data is deleted immediately and cascades across all database tables containing that child's data.
- Consent revocation: Parent revokes COPPA consent from Privacy & Data in Parent Settings. All active child data stored in the RegulateMe account is immediately deleted.
- Automatic retention cleanup: If an account is unsubscribed and has not been signed into for 60 consecutive days, all child data stored in the RegulateMe account is automatically deleted. Because this cleanup runs on the server, it cannot erase local-only copies on a device.
- Account deletion: Parents may start full account deletion from Parent Settings, then Delete Account. Account deletion requests are processed within 5 business days. When fulfillment runs, active child data is deleted immediately. Full account deletion also removes parental consent records, including their IP addresses and browser information. Provider billing and operational logs follow their stated retention schedules; minimized deletion completion evidence follows the 90-day schedule above.
4. Your Rights
Parents may review, export, or delete all child data stored in the RegulateMe account at any time from Privacy & Data in Parent Settings. A successful in-app child-data deletion or consent revocation clears local-only drawings and current Feelings Journal entries from the device where the action is completed. Copies on other devices, and local copies remaining after server-side 60-day cleanup, cannot be remotely erased and must be cleared on those devices. Parents may start account deletion from Parent Settings, then Delete Account. All requests are processed within 5 business days of receipt.
5. Contact
Questions about this policy: privacy@regulateme.app
Phone: (843) 606-0404
Mailing address: 4809 Harvest Moon Ct Summerville, SC 29485