Policies
Data retention
What we keep, for how long, why, and where; and how an account is deleted.
The schedule
Every class of data we hold has one row here. A row marked "when it ships" belongs to a product not offered yet and is stated now so the contract is known before the product exists.
| Data | Kept for | Why | Where |
|---|---|---|---|
| Request logs | 30 days | Security and finding a fault; never a body | Axiom, US East |
| Usage rollups (requests, errors, latency by hour) | 13 months | A year of your own usage on the portal and the account endpoint | Neon, US East |
| Idempotency rows (a key and the answer it produced) | 24 hours | A retry replays its answer instead of running twice | Neon, US East |
| The auth cache (a key's hash to its account and switches) | 30 seconds | One database read per key per half minute instead of one per request | Upstash, US East |
| Relay message content (when it ships) | Zero: transit only | A message passes to your Discord webhook and is not stored; only the request log line above remains | Nowhere |
| Erasure requests and receipts (when it ships) | 3 years | The record that a player's data was deleted; the plain user id is visible to the account for 90 days, then only an HMAC under a per-account key remains, which still proves the receipt for an id the account supplies | Neon, US East |
| Analytics raw events (when it ships) | The account's setting: 90 days by default, 30 at least, 400 at most | The events your game sends; the setting is yours | ClickHouse Cloud, US East |
| Analytics daily aggregates (when it ships) | Indefinitely | Counts by day with no user ids in them | ClickHouse Cloud, US East |
| Backups | 30 days | Recovery; a backup ages out on its own and is never restored to resurrect a deleted account | The vendor of each store above |
| A deleted account's tombstone (the account id, a hash of the Roblox user id, the deletion date) | 3 years | The proof the account was deleted, with nothing else in it | Neon, US East |
Deleting an account
- You ask, from the portal or with
DELETE /v1/account. The answer names the date the rows go. - Every key dies at once. Nothing is served to the account from that moment.
- A 30-day grace follows, during which we can undo the deletion if you ask.
- After the grace, every row the account owns is purged from every store, product by product, and the account row becomes the tombstone above. Backups holding the rows age out within 30 days of that.
- We send a written confirmation, with the date, to the address on the account, or to the Roblox account if there is no address.
Changes
A row added to this schedule with a product is announced on the changelog with the product. A change that shortens a row needs no notice; a change that lengthens one is announced 30 days ahead.