1. Principles
- Penny keeps what your team connects for as long as your team keeps it. A complete memory is what Penny is for, so nothing your team connected is deleted on a timer: it stays until a member deletes it (a source, a mailbox, or the whole team).
- When a source goes away (disconnected in Penny, uninstalled on the platform, token revoked, bot removed), its content stays in the team's memory and stops growing. Capture stops; deletion is a separate, manual step that a member takes in the Penny console. Once a member deletes it, there is no grace period and no undo.
- Deletion covers everything derived from the content: facts, entities, summaries, embeddings, search indexes, files, code checkouts, and stored answers and digests to the extent they quote it.
- Backups are not restored to bring deleted data back, except to recover from a disaster; if that happens, the deletion log (section 5) is replayed before the service reopens.
- Records Mintry must keep by law (billing, tax, legal holds) are kept apart from content, with the minimum data.
2. What happens when a source ends, and when its content is deleted
When a source ends, only the first two steps run. The rest run when a member deletes the source's content in the console.
| Step | When | How |
|---|---|---|
| Capture stops | at once, in the request or webhook that reports the event | the source is disabled; webhooks for it are dropped |
| Credentials destroyed | at once | Secret Manager versions destroyed |
| Content deleted from the live database and object storage | a deletion job starts when a member deletes the content; normally complete within 1 hour, at the latest within 24 hours (large sources are deleted in batches) | an idempotent, resumable background job; members see "Deleting…" then "Deleted" |
| Search indexes and embeddings | same job | vectors deleted with their rows |
| Object-storage soft-deleted copies | within 7 days | Google Cloud Storage soft delete |
| Database backups | age out within 7 days | Cloud SQL automated backups and point-in-time recovery, 7 days each |
| Workflow histories | within the workflow namespace's retention | Temporal Cloud |
| Confirmation | when the job completes | an event in the console, for example "Deleted 1,204 messages and 37 files from #design" |
In short: deleted within 24 hours, and from backups within 7 days after that.
Because deletion is irreversible, Penny says so before a member deletes a source's content. Disconnecting a source, or a Slack workspace admin or Telegram group admin removing Penny, does not delete it.
3. Retention schedule
| Data | Where | Kept |
|---|---|---|
| Messages, mail, files, facts, entities, embeddings of a source | Cloud SQL, Cloud Storage | until a member deletes them in the console; a source that is disconnected or removed keeps what it holds and stops growing (section 4.1) |
| Questions and answers, stored digests | Cloud SQL | while the team exists; citations and quoted text of a deleted source are removed with it |
| Mail and calendar records awaiting the personal-topics filter | Cloud SQL | hidden from every read until the filter has checked them; then kept as other content, or not kept if found personal |
| Code checkouts | code service disk | while the repository is connected |
| Connector credentials | Secret Manager | while connected; destroyed at once on any source end |
| Messages of a Telegram chat no team has claimed yet | Cloud SQL | 7 days, then deleted unless a team claims the chat |
| Telegram export awaiting import | Cloud Storage | until imported (the import starts right after the notice in the chat), or deleted if the uploader cancels or the bot is removed first |
| Export staging files after import | Cloud Storage | deleted when the import completes |
| Webhook deliveries awaiting routing | Cloud SQL, system-only table | 24 hours once processed; 7 days if processing failed |
| Account (email, name, sign-in method) | Cloud SQL | until the account is deleted |
| Acceptance records (Terms, Privacy Policy, DPA) | Cloud SQL | while the account exists, and as long as needed to establish or defend legal claims |
| Sign-in links | Cloud SQL | valid 15 minutes, single use |
| Session cookie | your browser | 14 days |
| Billing ledger, billing profile | Cloud SQL | while the team exists; on team deletion a content-free billing archive is kept for the statutory period |
| Invoices, payments, card data | Stripe | per Stripe and the statutory period for tax records |
| Emails sent (sign-in links, notices, digests) | Resend | per Resend's retention |
| Application logs (no message content) | Cloud Logging | 30 days |
| Cloud audit logs (no message content) | Cloud Logging | 400 days (fixed by Google) |
| Database backups | Cloud SQL | 7 days, plus 7 days of point-in-time recovery |
| AI provider copies | OpenRouter and model providers | none (zero data retention) |
| Tool-call logs (request arguments and responses) | Composio | up to 12 months, per Composio's retention; files staged for a tool call 24 hours |
| Deletion log (ids, counts and times; no content) | Cloud SQL | 3 years |
4. Events and what happens
4.1 Source disconnected, uninstalled, revoked, or bot removed
None of these deletes content. Capture stops (section 2); what was stored stays in the team's memory and stops growing until a member deletes it in the console:
| Event | What stops growing |
|---|---|
| A member clicks "Disconnect" on a source | that source |
| Penny's Slack app is uninstalled, or its tokens revoked | that Slack workspace |
| The Penny bot leaves or is removed from a Slack channel, or the channel is deleted | that channel (archiving a channel is not removal) |
| The Penny bot leaves or is removed from a Telegram chat | that chat |
| A member disconnects Gmail | that mailbox |
| A member disconnects Google Calendar, or unticks a calendar | those calendars and the meetings projected from them |
| The GitHub App is uninstalled, or a repository is removed from it | that repository |
| A database is disconnected | its data dictionary and cached query results |
A repository's code checkout, and a database's data dictionary and cached query results, are kept the same way; they go when a member deletes the source.
If Google reports that a mailbox's or calendar's access has lapsed (for example after a password change), Penny marks it as needing to be reconnected; its data stays until a member reconnects or disconnects it. A calendar that has needed reconnecting for more than 24 hours is left out of digests and Today.
When a member deletes a source's content, data that references several sources (a fact supported by messages from two chats) loses the deleted evidence; a fact whose only evidence came from the deleted source is deleted.
4.2 Team deletion
The team's owner deletes the team in the console's Settings ("Delete organization", confirmed by typing the team's name), or by writing to support@ipenny.app from the owner's email address; it also follows termination of the Terms.
- The team is marked as being deleted at once, and every member's session ends.
- Workflows are cancelled, credentials destroyed, the team's accounts and sessions at Composio removed, files and code checkouts deleted, and every database row of the team deleted. A content-free billing archive is kept for the statutory period. What cannot be removed is recorded in a content-free deletion log and finished by the operator.
- Penny stops reading every connected platform. Its app or bot may stay installed on a platform until an admin there removes it; it no longer stores anything for the deleted team.
- Within 24 hours; from backups within 7 more days. The Terms say "within 30 days", for margin.
- A certificate of deletion is available on request.
4.3 Member removed or leaves
The membership is deleted at once. Content the member contributed stays with the team. Sources the member connected (for example their mailbox, calendar, Granola or Fireflies account) stay with the team and keep syncing until a member disconnects them in the console. The owner cannot be removed and must transfer the role before leaving.
4.4 A person's deletion request
Requests go to privacy@ipenny.app (see the Privacy Policy, section 4.4). Penny has no self-service tool for erasing one person's data; the team deletes a source's content in the console, or instructs Mintry to carry out a request about one person (DPA, section 9.1).
4.5 Messages deleted at the source
When Slack reports that a message was deleted, or a Gmail message is deleted or moved to Trash, Penny marks its stored copy as deleted as soon as it learns of it. From then on the message is left out of search, answers and the console's feed, it can no longer be opened from an earlier answer, its entry in the search index is removed, and the facts that cite it are put up for review. The stored copy itself, with any files attached to it, is kept hidden until a member deletes its source's content or the team is deleted (sections 2 and 4.2). A Slack deletion is final: a later edit or re-read of the message does not bring it back. A Gmail message taken out of Trash is stored again and shown as before.
When Slack reports that a file was deleted, Penny deletes every message that shared it, the file and the facts derived from them.
Telegram's Bot API does not report deletions in groups.
5. Deletion log and legal holds
Every deletion is written to a deletion log (ids, counts and times; no content), so that deletions can be replayed if a backup ever has to be restored after a disaster.
If Mintry receives a preservation order, a litigation hold, or a law-enforcement request that it is legally obliged to honour, it may suspend deletion of the specific data concerned for as long as the obligation lasts. Mintry records the hold (scope, legal basis, start, review date), tells the customer unless the law forbids it, reviews it at least every 90 days, and does not use held data for any other purpose. A hold is the only exception to deletion once a member or Mintry has started it.