Data Retention Policy

Principles

We keep personal information only as long as it's needed to run your groups, and financial records as long as the law requires. Financial history is never destroyed early: payments, refunds and the ledger are how groups keep honest books (blueprint §101, §105).

How long we keep things

• Financial records — payments, refunds, credits, disputes, the ledger, receipts and payouts: 7 years after the transaction.
• Consent records — acceptances of these documents and autopay authorizations (including the wording you agreed to): while your account exists and 7 years after.
• Audit logs of administrative actions (who changed roles, issued a refund, etc.): as long as the group's financial records.
• Your account and profile: until you delete your account.
• Group content (chat messages, announcements, events, forms): while the group exists; deleted messages are cleared right away.
• Push-notification tokens: until you sign out of the device or delete your account.
• Server and security logs: [target 90 days — confirm].
• Email delivery records: [target 2 years — confirm].
• Backups: deleted information disappears from backups as they roll over, within [30 days — confirm with the database provider's backup window].

When you delete your account

You can delete your account yourself (Settings → Account on the web, or Profile → Privacy & account in the app). It's immediate and can't be undone.

Erased right away:

• Your name, email address, phone number, photo and emergency contact — on your profile and on every group's member list (you appear as "Deleted member").
• Your saved cards and bank accounts (also detached at Stripe, and your customer record at Stripe is deleted), and any autopay.
• Your notifications, notification settings and app devices.
• Your email history: our records of the emails we sent you keep no address or content. The "your account was deleted" confirmation keeps your address only until it has been sent.
• Your name, email and phone inside the group's activity history (audit log) — the entries stay, the personal details are removed.
• Household links where you pay for someone, or someone pays for you.
• Your sign-in (email/password, Apple or Google). If you signed in with Apple on an iPhone, we also ask Apple to revoke MyClub's access; on the web you can remove MyClub in your Apple ID settings.

Kept, without your name:

• Records of payments, refunds and credits, for 7 years, so groups' books stay correct.
• Messages you posted in group chats (shown as from "Deleted member") and your form answers and poll votes, which belong to the group's records.
• Consent records, as evidence of what was agreed.
• Email opt-outs and bounce/complaint blocks for your address: if you unsubscribed, or your address bounced or reported spam, we keep that address on our do-not-email list so no group can email it again after your account is gone. It's used for nothing else.

If you're the only owner of a group that still has members or has handled money, you'll first need to make someone else the owner (or contact us to close the group properly). A group with nobody else in it and no payment history is archived along with your account.

If an account is deleted another way (for example by our support team at your request), the same information is erased. A group it leaves without an owner is flagged for our support team, who contact the group to hand it over.

Getting a copy first

Before deleting, you can download everything we hold about you as a file (Settings → Account → Download my data). Questions: support@usemyclub.com.