Data & Retention Policy
Retention controls, approved targets and the limits of deletion.
Effective 2 November 2026
Pryn Team · Operator contact: Mostafa Eyd · [email protected]
How to read this policy
Retention must be proportionate to the record’s purpose. Pryn Team’s standard targets are 30 days after closure for support records, 30 days for ordinary diagnostic logs and backup rotation, and 90 days after submission for staff applications. These are operational targets, not a claim that this website update adds deletion jobs to the bot.
Where an automated control is absent or retention is configurable, records require operator or server-staff handling. Retention can be extended only for a specific unresolved support matter, security investigation, dispute or legal requirement, with access limited to that purpose. Contact us for the handling of a particular record.
Tickets and transcripts
ModMail’s default retention setting is 30 days after closure and can be configured by server staff. Cleanup requires the bot’s maintenance routine to run successfully. Channel-ticket transcripts are separate exports held on the host and in the configured Discord archive; those copies are not covered by the same verified automatic schedule. Their 30-day target requires separate review and deletion.
Server staff can export or download copies. PrynBot cannot erase copies held independently by recipients. Closing a ticket is not the same as deleting its transcript. Ask the server team about their configured retention and contact Pryn Team for copies under our control.
AI session and knowledge
AI memory is bounded and isolated by ticket. Closing the ticket clears its AI conversation session. This does not erase the separate transcript, moderation history or provider metadata. Operational AI records without an active session have a reviewed 30-day cleanup. Public support guidance may be indexed while needed for the enabled AI feature.
Accounts and community records
Dashboard sessions last up to seven days and OAuth sign-in state up to ten minutes. Session expiry does not delete the account, encrypted credentials or subscription records. Staff application sessions last up to two hours.
Account configuration is retained while needed to provide access. Server configuration, moderation cases, XP and campaign records follow their ongoing operational purpose and server configuration rather than a universal 30-day timer. Removal or a verified deletion request triggers assessment of records still required for service, security, disputes or legal obligations. We explain any justified exception rather than promising deletion of every record on uninstall.
Applications and billing
Live staff applications and associated reviews expire 90 days after submission through host maintenance. Applicants can withdraw an active application or delete their application records; withdrawal erases live answers, while deletion removes the record and reviews. Backups require separate handling.
Billing-event deduplication records have a separate 90-day cleanup. Subscription and financial evidence is retained only as needed to administer billing, meet applicable accounting obligations and handle disputes. Stripe’s records and legal retention are separate from local subscription state.
Logs, backups and restoration
The approved target for ordinary diagnostics and rotating backups is 30 days. This website-only release does not configure the host’s log or backup rotation. In particular, the bot’s manual backup command creates private backups that are not automatically removed by case retention. Ask Pryn Team about any copy awaiting manual rotation or deletion.
Backups are for recovery, with restricted access. A deletion request must also be recorded for recovery handling so that restoring an older backup does not return erased data to ordinary use without review. Legal or investigation copies are kept separately for the relevant purpose, not as a reason to retain every backup indefinitely.
Temporary encrypted files
The transfer service accepts files up to 150 MiB, with 200 MiB aggregate reserved temporary capacity. Browser-encrypted chunks, metadata, identifiers, sizes, expiry times and encrypted file-key wrappers are held in Cloudflare D1. New downloads stop one hour after upload completion. Incomplete uploads expire after fifteen minutes.
The scheduled Worker targets expired records each minute and retries failures. Physical removal from the live database can be delayed. D1 Time Travel can retain recoverable historical database state: Cloudflare currently documents seven days on Free and thirty days on Paid. Logical deletion is not a promise of immediate removal from provider backups. Downloaded copies cannot be recalled.
Transfer sessions last thirty minutes. The application stores a password verifier and uses secret-derived IP digests for rate-limit records; Cloudflare may separately process request information. Complete links contain the decryption secret in the fragment and must be shared privately.
Making a request
Email [email protected] with the relevant account ID and record type. Do not send your password, API keys or identity documents in the first message. We will verify the request proportionately, identify copies under our control and explain any limits, exemptions or separate server responsibility. Read the request guide.