1. Principles
- Penny keeps what your team connects for as long as your team keeps it. A complete memory is what Penny is for, so nothing your team connected is deleted on a timer: it stays until a member deletes it (a source, a mailbox, or the whole team).
- When a source goes away (disconnected in Penny, uninstalled on the platform, token revoked, bot removed), its content is deleted immediately. There is no grace period and no undo.
- Deletion covers everything derived from the content: facts, entities, summaries, embeddings, search indexes, files, code checkouts, and stored answers and digests to the extent they quote it.
- Backups are not restored to bring deleted data back, except to recover from a disaster; if that happens, the deletion log (section 5) is replayed before the service reopens.
- Records Mintry must keep by law (billing, tax, legal holds) are kept apart from content, with the minimum data.
2. What "immediately" means
| Step | When | How |
|---|---|---|
| Capture stops | at once, in the request or webhook that reports the event | the source is disabled; webhooks for it are dropped |
| Credentials destroyed | at once | Secret Manager versions destroyed |
| Content deleted from the live database and object storage | a deletion job starts at the event; normally complete within 1 hour, at the latest within 24 hours (large sources are deleted in batches) | an idempotent, resumable background job; members see "Deleting…" then "Deleted" |
| Search indexes and embeddings | same job | vectors deleted with their rows |
| Object-storage soft-deleted copies | within 7 days | Google Cloud Storage soft delete |
| Database backups | age out within 7 days | Cloud SQL automated backups and point-in-time recovery, 7 days each |
| Workflow histories | within the workflow namespace's retention | Temporal Cloud |
| Confirmation | when the job completes | an event in the console, for example "Deleted 1,204 messages and 37 files from #design" |
In short: deleted within 24 hours, and from backups within 7 days after that.
Because deletion is immediate and irreversible, Penny says so before a member disconnects a source, and explains that a Slack workspace admin or a Telegram group admin can trigger it by removing Penny.
3. Retention schedule
| Data | Where | Kept |
|---|---|---|
| Messages, mail, files, facts, entities, embeddings of a connected source | Cloud SQL, Cloud Storage | while the source is connected; deleted at once when it goes away (section 4.1) |
| Questions and answers, stored digests | Cloud SQL | while the team exists; citations and quoted text of a deleted source are removed with it |
| Held ("hidden") mail threads | Cloud SQL | while the mailbox is connected |
| Code checkouts | code service disk | while the repository is connected |
| Connector credentials | Secret Manager | while connected; destroyed at once on any source end |
| Messages of a Telegram chat no team has claimed yet | Cloud SQL | 7 days, then deleted unless a team claims the chat |
| Telegram export awaiting the 48-hour notice period | Cloud Storage | until imported, or deleted if the uploader cancels or the bot is removed first |
| Export staging files after import | Cloud Storage | deleted when the import completes |
| Webhook deliveries awaiting routing | Cloud SQL, system-only table | 24 hours once processed; 7 days if processing failed |
Opt-out markers (/forgetme) | Cloud SQL | while the source exists, so the person's messages keep being left out |
| Account (email, name, sign-in method) | Cloud SQL | until the account is deleted |
| Acceptance records (Terms, Privacy Policy, DPA, connect-step checkboxes) | Cloud SQL | while the account exists, and as long as needed to establish or defend legal claims |
| Sign-in links | Cloud SQL | valid 15 minutes, single use |
| Session cookie | your browser | 14 days |
| Billing ledger, billing profile | Cloud SQL | while the team exists; on team deletion a content-free billing archive is kept for the statutory period |
| Invoices, payments, card data | Stripe | per Stripe and the statutory period for tax records |
| Emails sent (sign-in links, notices, digests) | Resend | per Resend's retention |
| Application logs (no message content) | Cloud Logging | 30 days |
| Cloud audit logs (no message content) | Cloud Logging | 400 days (fixed by Google) |
| Database backups | Cloud SQL | 7 days, plus 7 days of point-in-time recovery |
| AI provider copies | OpenRouter and model providers | none (zero data retention) |
| Deletion log (ids, counts and times; no content) | Cloud SQL | 3 years |
4. Events and what happens
4.1 Source disconnected, uninstalled, revoked, or bot removed
All of these trigger the same immediate deletion (section 2):
| Event | What is deleted |
|---|---|
| A member clicks "Disconnect" on a source | everything from that source |
| Penny's Slack app is uninstalled, or its tokens revoked | everything from that Slack workspace |
| The Penny bot leaves or is removed from a Slack channel, or the channel is deleted | everything from that channel (archiving a channel is not removal) |
| The Penny bot leaves or is removed from a Telegram chat | everything from that chat |
| A member disconnects Gmail | everything from that mailbox |
| A member disconnects Google Calendar, or unticks a calendar | every event and attendee row of those calendars, and the meetings projected from them |
| The GitHub App is uninstalled, or a repository is removed from it | that repository's checkouts and everything derived from its code |
| A database is disconnected | its data dictionary and cached query results |
If Google reports that a mailbox's or calendar's access has lapsed (for example after a password change), Penny marks it as needing to be reconnected; its data stays until a member reconnects or disconnects it. A calendar that has needed reconnecting for more than 24 hours is left out of digests and Today.
Data that references several sources (a fact supported by messages from two chats) loses the deleted evidence; a fact whose only evidence came from the deleted source is deleted.
4.2 Team deletion
The team's owner can have the team deleted by writing to support@ipenny.app from the owner's email address (self-service deletion in Settings is planned), or it follows termination of the Terms.
- Mintry confirms the request with the owner, and all members are told.
- Workflows are cancelled, credentials destroyed, files and code checkouts deleted, and every database row of the team deleted. A content-free billing archive is kept for the statutory period.
- Penny is removed from connected platforms where their APIs allow it.
- Within 24 hours; from backups within 7 more days. The Terms say "within 30 days", for margin.
- A certificate of deletion is available on request.
4.3 Member removed or leaves
The membership is deleted at once. Content the member contributed stays with the team. The owner cannot be removed and must transfer the role before leaving.
4.4 A person's deletion request or opt-out
/forgetme in a Telegram chat, or /penny forgetme in Slack: capture of that person's messages in that chat stops at
once; what was stored from them there (records, files, vectors, facts attributed to them) is deleted within 24 hours,
and at the latest within 30 days. Requests by email go to privacy@ipenny.app (see the Privacy Policy,
section 4.4).
An opt-out by email address (a Gmail correspondent, or a meeting attendee in a connected Google Calendar, asking through privacy@ipenny.app): Penny stops storing that address for the team, deletes the attendee rows it has for it and the mail it holds from it, within the same 24 hours (30 days at the latest). The meetings themselves stay in the calendars of the members who shared them, without that attendee.
4.5 Messages deleted at the source
When Slack reports that a message or file was deleted, Penny deletes the record, its file and the facts derived from it.
Telegram's Bot API does not report deletions in groups; the join notice points people to /forgetme.
5. Deletion log and legal holds
Every deletion is written to a deletion log (ids, counts and times; no content), so that deletions can be replayed if a backup ever has to be restored after a disaster.
If Mintry receives a preservation order, a litigation hold, or a law-enforcement request that it is legally obliged to honour, it may suspend deletion of the specific data concerned for as long as the obligation lasts. Mintry records the hold (scope, legal basis, start, review date), tells the customer unless the law forbids it, reviews it at least every 90 days, and does not use held data for any other purpose. A hold is the only exception to immediate deletion.