Skinmetric
Retention schedule
Last updated July 29, 2026
This table is generated at build time directly from our internal retention-schedule document — the same document engineering uses to write the deletion code itself — so it can't quietly drift out of sync with what the running system actually does. If you'd rather read the narrative version, see ourprivacy policy.
Anti-promise rule (founding §6): nothing here is ever surfaced to users as "deleted immediately" — a provider or backstop window always applies, and is stated as such.
| Data class | Retention | Deletion mechanism |
|---|---|---|
| Photo originals | Never leave the device | N/A — server never receives them (rule 5) |
| Analysis crops (normalized, transient) | Deleted immediately after the analyze call; backstop sweep purges anything older than 24h (should never fire) | Synchronous hard-delete in analyze's own request path; nightly run_retention_sweep() as the safety net |
| Anthropic (vision LLM provider) API-side copy | ~7 days, per Anthropic's own API data-retention window — outside our control, disclosed, never claimed "deleted immediately" | N/A (provider-side) |
| Scans + metrics (the product's own longitudinal record) | Kept until the account is deleted — this is the product (delta-not-rating timeline, rule 2) | Cascades on account deletion only |
| Encrypted cloud backup (opt-in, post-purchase) | Kept while backup is enabled; purged immediately on disable or account deletion | Audited RPC + Storage API removal, one deletion_log row per purge |
| Device sessions (anonymous-first quota/abuse identity) | 90 days of inactivity (last_seen_at) — 3x FR-11's 30-day quota cycle, comfortably past any legitimate reinstall-abuse-correlation use | Nightly run_retention_sweep() |
| Consent records — active | Indefinitely, while the consent stands (compliance evidence) | Never auto-deleted |
| Consent records — revoked | 3 years past revoked_at — TODO(counsel): engineering placeholder, not a settled legal window | Nightly run_retention_sweep() |
| Entitlements / quota ledger | Kept until account deletion (needed for the account's own billing/quota state while it exists) | Cascades on account deletion |
| RevenueCat subscriber record | Deleted (best-effort) at account-deletion time | DELETE /v1/subscribers/{id} via RevenueCat's REST API |
| Apple Sign-In token | Not implemented — known gap, see below | — |
| deletion_log (proof-of-deletion audit trail) | Indefinitely — must outlive the account it documents | Never deleted; no FK to auth.users on purpose |
Two ways data actually gets deleted
You ask. The in-app Privacy Center's Delete Everything flow removes your account and every server-side record in one step, then erases the encrypted local photo store on your device.
It ages out. A nightly automated sweep is the backstop for anything that should already be gone or that ages out on a timer — orphaned analysis crops, inactive anonymous device sessions, revoked consent records past their window. Every sweep-driven removal is written to an internal, audited log, the same as a user-requested one.
Questions
privacy@skinmetric.aqx.llc — or use Delete Everything in the app's Privacy Center directly.