Data Retention Schedule

Last reviewed: August 3, 2026

What we keep, how long we keep it, and what happens when you delete your account. Publishing this is a requirement of the amended Children's Online Privacy Protection Rule and is expected by state student-privacy laws and most district agreements.

Principles

Keep it only as long as it is useful to the person it belongs to. Your training history is your record of your own work. We do not expire it out from under you while your account is active.
Delete on request, promptly. Account deletion is self-service in the app, and it is real deletion, not deactivation.
Retain beyond that only where the law or a counterparty's own records require it - and name the carve-out rather than hiding behind a general clause.
In the school channel, the institution controls the clock. A district or university can require deletion at any time and at contract end, and that instruction overrides everything below.

Retention by category

Category	Examples	While active	On account deletion
Account and profile	Name, email, birthdate, avatar, roles	Life of account	Deleted
Training records	Sessions, workouts, sets, runs, techniques, journals	Life of account	Deleted
Health and body	Weight, measurements, sleep, imported health metrics	Life of account	Deleted
Uploaded media	Technique video, film-review clips, photos	Life of account	Deleted, including the stored files
Messages	Chat threads, broadcasts, notifications	Life of account	Deleted. A counterparty's copy of a shared thread remains theirs
Organization membership	Roster rows, attendance, check-ins, reservations	Life of the membership	Membership ended. Roster history remains the organization's own record
Analytics and diagnostics	Product events, error reports	24 months rolling	Disassociated from the account
Marketing and engagement	Email opens and clicks, campaign enrollment, opt-out state	Life of account	Deleted, except suppression records - see below
Payments	Transaction, payout and refund records	Life of account	Retained for tax and financial records. Card data is never held by us
Signed records	Waivers, membership agreements, contracts	Life of the record	Retained by the organization you signed with - see below
Tax forms	Form W-9	Life of the record	Retained by the organization. The taxpayer identification number is written into the PDF and discarded; only the last four digits are kept as app data
Compliance documents	Medical clearance, bloodwork, physical	Until expiry, plus the event's record period	Retained as the organization's event record
Security and audit logs	Administrative actions, authentication events	24 months	Retained - required for tamper evidence
Vulnerability reports	Report body, attachments, hashed IP	24 months after closure	Not applicable - reporters may be anonymous
Emergency and medical	Emergency contact name, phone and relationship; medical notes; allergies	Life of the membership it was given to	Deleted with the account. The organization's copy ends with the membership
Member administration	Staff notes about a member; membership history such as joined, approved, role changed, removed	Life of the organization's record	Retained by the organization as its own record - see below
Rights requests	Contact email, the request itself, hashed IP	24 months after the request is closed	Not applicable - the requester is often not an account holder

Named carve-outs

These survive account deletion, and here is why:

Signed records. A signature is legal evidence belonging to both parties. The gym, school or organizer that collected it keeps its copy for its own liability and record-keeping period. Deleting your account does not erase someone else's executed agreement with you.
Financial records. Transaction and payout history is retained to satisfy tax and accounting obligations.
Suppression records. If you unsubscribe or reply STOP, we keep the minimum record needed to honor that choice. Deleting it would resubscribe you.
Security and audit logs. Kept so access to data can be reconstructed after an incident. They are not used for anything else.
Membership history. Who approved someone, who changed their role, who removed them and when. This is the organization's record of its own decisions, and it is what answers a later dispute about what happened, so it outlives the individual membership.
Rights-request records. Kept so we can show a regulator which requests we received and how each one was handled. Deleting the record of a deletion request would defeat the purpose of keeping one.

How deletion actually works

Soft delete, then purge. Records are first marked deleted so the deletion propagates correctly to offline devices, then removed.
Organization deletion has a 30-day recovery window before it becomes permanent, protecting a whole gym or team from an accidental or malicious deletion by one account holder.
Account deletion purges stored files, not only database rows - your uploaded media and any store media you own. The carve-outs above are the exception.
Backups. Deleted data can persist in encrypted point-in-time backups until they age out on their normal cycle. Backups are never used to restore an individually deleted record.

Schools and universities

Under an executed data privacy agreement, the institution's instruction governs:

Deletion or return of student data at contract termination, by the institution's chosen method and within the period the agreement sets.
Deletion on demand during the term, for one student or in bulk.
We retain no student data after termination for any purpose of our own, and our agreement template claims no right to keep de-identified or aggregated student data.

Asking for deletion

In the app: More, then account settings, then delete account. Self-service and immediate.
By email: help@susos.co.
For a student under a school agreement: contact the school or district, which routes the request to us. Students 18 and older at a college or university hold the right directly and can contact us themselves.