Data Retention and Disposal Policy
Budgetfold · Version 1.0 · Effective September 22, 2026 · Reviewed at least annually · Supplements the Privacy Policy and Information Security Policy
1. Purpose
This policy defines how long Budgetfold (operated by Dean Gergoric, doing business as Pomalo) keeps each category of personal and financial data, when and how it is deleted, and how consumers exercise their rights. It is written to comply with the California Consumer Privacy Act (CCPA/CPRA), other US state privacy laws, Canada's PIPEDA, and Plaid's End User Privacy Policy and developer obligations.
2. Principle
We keep personal data only as long as it is needed to provide the service the user asked for. Nothing is retained for marketing, profiling, or resale. When a purpose ends, the data is deleted on the schedule below.
3. Retention schedule
| Data | Where | Retained until |
|---|---|---|
| Account profile (email, display name, user ID) | Firebase Authentication, Firestore | Account deletion by the user |
| Budget entries the user types (income, categories, expenses) | Firestore | Deleted by the user, or when the budget or account is deleted |
| Invite codes | Firestore | Expire automatically after 7 days; deleted when the creator's account is deleted |
| Plaid access tokens | Firestore (server-only collection) | Deleted immediately when the user unlinks the bank or deletes their account |
| Linked account metadata (institution, account name, last four digits) | Firestore | Deleted immediately on unlink or account deletion |
| Imported transactions (date, amount, merchant, category, pending flag) | Firestore, inside the user's budgets | Kept as budget entries while the account exists; all Plaid-derived data for an unlinked bank is purged within 30 days of unlink; all deleted on account deletion |
| Subscription entitlement (status and expiry only, no payment details) | Firestore | Account deletion; Apple holds all payment data |
| Server logs (function invocations, user IDs, error messages; never tokens or secrets) | Google Cloud Logging | 30 days, then automatically deleted |
| Firestore point-in-time recovery data | Google Cloud | 7 days rolling, then automatically discarded |
| Support email correspondence | Gmail | Deleted 12 months after the request is closed |
4. Consumer rights and requests
- Deletion, self-service. Profile › Delete Account permanently deletes the profile, every budget the user owns, their membership in shared budgets, all imported transactions and linked-account records, their Plaid access tokens (with Plaid's item removed via the API), and their sign-in credentials. Deletion is immediate and irreversible.
- Unlink a bank, self-service. Profile › Bank Accounts › swipe to unlink. The Plaid item is removed and the access token deleted at once.
- Access, correction, portability, and deletion by request. Email dgergoric2@gmail.com. Identity is verified by replying from the account's email address. Requests are acknowledged within 10 days and fulfilled within 45 days, as required by CCPA, and sooner in practice.
- We do not sell or share personal data, so there is no opt-out to exercise. We do not discriminate against users who exercise their rights.
5. Disposal method
- Deletion is performed by permanent document deletion in Firestore and user deletion in Firebase Authentication. Google Cloud overwrites deleted data in its storage systems and purges it from backups within their published windows.
- Plaid connections are terminated with Plaid's
/item/removeendpoint so Plaid stops retaining the connection on our behalf. - Secrets are disposed of by destroying the Secret Manager version. No data is stored on removable media or self-managed servers, so there is no physical disposal step.
6. Enforcement
- Self-service deletion and unlinking are implemented in the app and backend and tested before each release.
- A scheduled cleanup job removes expired invite codes and purges Plaid-derived data past its retention window.
- The security owner verifies the schedule above during the annual policy review and after any change to what data the app collects.
7. Review
This policy is reviewed at least annually, and whenever the app begins collecting a new category of data or the law changes. The effective date above is updated on each revision.
Contact: Dean Gergoric, Founder and Developer, dgergoric2@gmail.com