Data Retention and Deletion Policy

Purpose and standard periods

We keep only information needed for the beta, security, support or a documented legal obligation. Managed raw video/audio, selected frames and intermediate/debug artifacts are deleted after 24 hours once a job is terminal. New managed reports, transcripts, source/evidence files and job metadata expire 30 days after completion. Browser session expiry is 480 minutes; OAuth state expires after ten minutes. Expired rows are periodically cleaned. Job-specific validated caches expire after two hours and are removed with the job.

Account identity is retained while needed for invited access and scheduled for deletion after 365 days without sign-in. Policy acceptance records last while the account exists; a minimal hashed security event can remain for 730 days. Closed support cases are removed after 180 days. Open cases are reviewed by the operator, not treated as automatically resolved. The security-event period is a conservative beta setting, not a claim that all databases have identical statutory duties.

Your deletion controls

You can request deletion of an individual check or your account in account privacy controls. Access is restricted immediately; queued work is cancelled and active work is stopped before files are removed. The worker normally removes live-system records on its next maintenance cycle, within five minutes when healthy; downtime or a justified hold can delay completion. Account deletion also removes associated sessions, account details and acceptance records and scrubs linked support text. To stop future re-registration the operator must also remove the email from the configuration allowlist.

Non-users, rights holders and people mentioned in material may request access, correction or removal at orianjlevari@gmail.com or orianjlevari@gmail.com. We assess identity and legal grounds proportionately. A necessary legal/dispute hold may delay erasure; the operator must record the reason outside broad application logs, limit access, set an expiry and review renewal. Hidden results are not silently presented as current assessments.

Historic data, backups and providers

Reports that predate managed retention remain private and are not silently deleted by this update. The operator must inventory them and explicitly migrate justified files to a retention schedule or delete them before launch. This is a launch-review item, not an unlimited archival permission.

Backups must be protected, excluded from normal use and expired within 30 days unless a documented legal exception applies. Backup expiry and restoration are operator procedures, not an automatic OCI backup configuration. Preserve the current deletion journal separately and replay it before making a restored backup available. Data already sent to providers cannot be recalled by deleting CAP's copy; supplier retention, legal obligations and request procedures apply separately.

What deletion means

CAP removes filesystem entries and database records using validated paths and SQLite secure-delete settings, and records minimal deletion references for the backup window. This is logical deletion from the live service. It does not guarantee physical overwriting of SSD blocks, SQLite WAL copies, cloud snapshots, backups or third-party systems. Host administrators must perform quiescent database compaction/checkpointing and backup/provider cleanup where needed. We do not promise instantaneous irreversible erasure from every system.

Contact and requests

Report an incorrect or harmful result · Privacy, access or deletion · Copyright or removal

You do not need an account to email the operator. Do not send unnecessary sensitive information or identity documents.