Data Retention Summary
1. The rule
A retention period is a maximum, not a target. Data kept beyond its period is a liability rather than an asset. Five kinds of record outlive the account, and section 4 says which, why and when each ends.
One rule decides which document applies. This schedule controls how long each kind of data is kept and when it is removed. The Privacy Policy controls what is collected, why, and your rights over it, and it restates these periods; where a period there differs from this schedule, this schedule applies and the difference is an error we correct.
2. How long each kind of data is kept
| What it is | Kept for | Removed when |
|---|---|---|
| Your working data: lists, watchlists, reviews, sign-offs, document requests, notification routes, onboarding progress | The life of your account, plus 30 days | 30 days after you close the account |
| Derived state held by this website: digests, drift events, history of past readings | 24 months, rolling | It passes 24 months, or you close the account |
| The hourly continuity series: for each listed company, whether it was witnessed at each hourly sweep (the basis of the continuity figures on a profile) | 400 days, rolling | It passes 400 days. This is a different dataset from the history of past readings above, which is why the periods differ |
| Snapshots of lists a workspace watches | 400 days, and never more than the newest 40 per list | It passes 400 days, is the 41st newest, or you close the account |
| A published profile and its endorsements and domain claims | While published, plus 30 days | 30 days after you unpublish. An opt-out is immediate |
| Records of who accessed a document you shared | 24 months | It passes 24 months. These records cannot be altered before then |
| Team membership | The life of the workspace | Immediately on removal |
| Access tokens and feed credentials | The life of the account | Immediately on rotation or closure |
| Rate limiting counters | 7 days | It passes 7 days |
| Invitations that were never accepted | 12 months | It passes 12 months |
| Requests sent to a trust center | 24 months | It passes 24 months |
| Dispute files: the filer's address, relationship and message | 24 months after the dispute is resolved, or 36 months after filing if never resolved. See section 4 | It passes that date |
| Copies of cookie choices (receipts) | 24 months after the choice; the page and user agent 90 days. See section 4 | It passes that date |
Which action does what, and when
As section 1 says, this schedule controls retention periods. Three different things are often called deletion, and each has its own clock. Every clock in the last column starts when the data leaves live systems, because a backup made before that moment can still hold it, and each backup expires a fixed number of days after it is made.
| Action | What stops at once | Removed from live systems | Gone from backups |
|---|---|---|---|
| You delete one item (a list, a review, a route) | It is no longer shown or used | Immediately | Within 35 days |
| You disconnect an integration | Trooth stops reading with its credential | The credential within 24 hours | Within 35 days after that, so at most 36 days after you disconnect |
| You close your account | Sign-in, sessions, tokens and feed credentials | Working data within 30 days | Within 35 days after that |
| You unpublish a profile | The public profile and its badge | Its content within 30 days | Within 35 days after that |
| You opt a listing out | The public listing | Descriptive content immediately; the domain and the opt-out are kept so it stays out | Within 35 days |
Two kinds of record are kept for a fixed period whatever you delete, because their purpose is to be a record: security and authentication logs for 12 months, and records of who opened a document a company shared for 24 months. Neither can be altered before its period ends.
3. Backups
A nightly encrypted database dump of this website's records is taken and kept for 30 days, and the account service keeps its own daily export for 35 days.
A deletion is not complete until it has aged out of backups. Data that has left live systems can persist in backup copies for up to 35 days after it left, because the last backup made before then still holds it; those copies then expire automatically. That is the honest statement and it is the one to rely on.
Which data each backup holds, and the longest a deleted item can survive end to end:
| Dataset | Where it lives | Backup kept | Longest from your action to gone everywhere |
|---|---|---|---|
| This website's records: profiles, lists, reviews, sign-offs, document requests, notification routes, consent receipts | The website's database | 30 days (nightly dump) | Deleting one item: 30 days. Closing an account or unpublishing: 30 days to leave live systems, then 30 days of backup, so 60 days |
| The account service's records: sign-in, sessions, workspace membership and connector credentials | The account service at api.trooth.co | 35 days (daily export) | Deleting one item: 35 days. Disconnecting: up to 36 days, because the credential can take 24 hours to leave live systems and the last export that holds it is kept 35 days. Closing an account: 30 days, then 35 days of backup, so 65 days |
If a backup is restored. Before this website is pointed at a database restored from a backup, the restore procedure reapplies every account erasure, every email opt-out, and every revoked share link, attestation invitation and connector publishing authorization made since that backup was taken. It reads them from a separate record of those acts, kept with the nightly export and, for erasures, also by the account service, and it is run in the monthly restore rehearsal. Other deletions are not reapplied automatically: an item you deleted on its own, or a profile you unpublished, after the backup was taken can come back with the restored copy until it is deleted again. The account service at api.trooth.co has no such replay for its own export yet, so restoring that export can bring back an item deleted, or a credential disconnected, after the export was taken. The backup clocks above still apply to every copy.
Error reports, transactional email records and application logs are held by the providers named in the Sub-Processor List, under their own retention periods, which this table does not cover.
4. What is kept longer than the account, and why
Five kinds of record outlive the account they came from. Each is a deliberate exception, and each has a stated purpose, the minimum it holds, who can read it and when it ends. Where the record would otherwise carry personal content, the content is removed on a schedule and only the event that serves the purpose is kept.
| Record | Why it is kept, and on what basis | What is kept | Who can read it | When it ends |
|---|---|---|---|---|
| Copies of cookie choices (receipts) | To show that a choice was made, which the law asks of consent (GDPR Article 7(1)); a legal obligation | A random receipt id, the consent version, the action, the category answers, whether a Global Privacy Control signal was on, and the time. No IP address, email or account. The page it was made on and the browser's user agent are removed after 90 days | Trooth's system connection only; the application can add a receipt and cannot read, change or delete one | 24 months after the choice: the 12 months a choice applies, and 12 more to answer a question about it |
| Correction history | To show what a page said and how it changed, which is the purpose of a correction record; legitimate interests | The domain, the fact, the outcome and the date. It names no person | Public on the company's page | Kept while Trooth publishes the Network. It holds no personal data |
| Dispute files | To handle a dispute and answer questions about how it was handled; legitimate interests | While a dispute is open: the filer's address, their stated relationship and their message. After it is resolved: the domain, the kind, the fact, the status, the outcome and the dates | Trooth's system connection only; never the company the dispute is about | The filer's address, relationship and message are removed 24 months after the dispute is resolved, or 36 months after it was filed if it was never resolved. The resolved record ends with the correction history |
| Opt-out records | So that a permanent opt-out stays permanent and a later observation cannot recreate the listing; legitimate interests and the company's objection | The domain and the fact of the opt-out. The descriptive content is deleted | Trooth's system connection only | Kept while Trooth publishes the Network, because deleting it would undo the opt-out |
| Corporate records and executed agreements | Corporate and formation records as statute requires; agreements for their life plus the applicable limitation period; legal obligation | The record itself | Trooth, LLC | As statute requires, or the life of the agreement plus the limitation period |
The removals in this table run every day. A backup restored from before one of these removals is swept again on the next daily run, so a restore cannot bring content removed under this table back for longer than a day, and backups themselves expire within 35 days of being made. A request to erase personal data that one of these records holds is assessed against the purpose in the table; the answer is either a removal or the specific reason the minimum is kept, never a refusal without one.
5. Deleting your data
| What you ask for | What happens | How long |
|---|---|---|
| Close your account | Working data purged from live systems | 30 days |
| Opt a listing out | Descriptive content deleted; domain and opt-out fact retained | Immediate |
| Erasure of personal data | Live systems purged; dispute and opt-out records assessed individually | 30 days |
| Backup expiry | Automatic, no action needed | Within 35 days of leaving live systems; 36 days from disconnecting an integration |
An erasure request touching a dispute record is assessed rather than executed automatically, because the correction history exists to protect other parties and a blanket rule in either direction would be wrong. Where a record is retained against a request, you are told which record and why.
Requests go to privacy@trooth.co.
Revision note. Revised September 4, 2026. One row of the retention table referred to a history of a composite figure. Trooth does not compute or publish a composite figure; a Trust Profile reports what was witnessed and when. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 23, 2026. The derived-state row in section 2 named a history of check counts, a measure this product no longer uses; it now names the history of past readings, which is what is kept. An earlier revision note above described a Trust Profile by a count of checks, a measure this product no longer uses; it now says what a profile reports. Spelling is now American throughout, as Trooth is a Florida limited liability company, and dates are written month first. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 26, 2026. The backup section said no backup is kept longer than 30 days. The website's nightly dump is kept for 30 days, and the account service's daily export is kept for 35, so a deleted record can persist in a backup for up to 35 days; the section and the table now say so, as the Privacy Policy already did. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 26, 2026. A new section, Which action does what, and when, sets out in one table what stops at once, what leaves live systems and when, and when a backup copy expires, for each deletion action. The schedule said data deleted from live systems is gone immediately and, elsewhere, that working data is purged 30 days after an account closes; both are true of different actions, and the table now says which is which. It also names the two records kept for a fixed period whatever is deleted. No right or obligation was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 27, 2026. Copies of cookie choices are added to the records kept indefinitely, with the reason and what a copy holds, as the Privacy Policy and the Cookie Policy now describe. No right or obligation was narrowed, and the change is recorded under our publication and correction policy.
Revision note. Revised September 28, 2026. Section 1 said the Privacy Policy governs where the two documents differ, while section 2 called this schedule the controlling statement. They now say one thing: this schedule controls retention periods and the Privacy Policy controls what is collected and why. The hourly continuity series and watched-list snapshots, each kept 400 days, are added to the table beside the 24-month history of past readings, because they are different datasets and were being read as one. The backup section now says which records each backup holds and the longest a deleted item can survive end to end. No period was lengthened, no right or obligation was narrowed, and the correction is recorded under our publication and correction policy.
Revision note. Revised September 28, 2026. Section 4 kept dispute records and copies of cookie choices indefinitely. Each exception now states its purpose, its basis, what it holds, who can read it and when it ends: cookie receipts are deleted 24 months after the choice, and lose their page and user agent after 90 days; a dispute's filer address, relationship and message are removed 24 months after it is resolved; the correction history and opt-out records, which hold no personal data, are kept while the Network is published. The removals run daily. No period was lengthened, and the change is recorded under our publication and correction policy.
Revision note. Revised October 4, 2026. Wording only: the word this document used for a single number summing a company up, in its clauses and in the earlier revision notes above, is now "composite figure" or "rating", the words used everywhere else Trooth publishes. The meaning is unchanged: no right or obligation was added, narrowed or removed, and the correction is recorded under our publication and correction policy.
Revision note. Revised October 4, 2026. Each backup clock now says where it starts: when the data leaves live systems, because a backup made before then can hold it. Disconnecting an integration was given as 35 days end to end while the credential can take 24 hours to leave live systems; the longest it can survive is 36 days, and the schedule now says so. A new paragraph in section 3 states what a restore from backup reapplies before the website uses the restored copy (account erasures, email opt-outs and recorded revocations) and what it does not, including the account service, which has no such replay yet; the daily sweep in section 4 is stated as applying to the removals in that table. No period was lengthened by this note: the 36 days was already the effect of the stated 24 hours and 35 days. The correction is recorded under our publication and correction policy.