This Data Retention Policy describes how long Arizu Studio ("we", "us", "our") keeps personal data processed through Money Tracker, and how it is deleted. It supplements our Privacy Policy, in line with the storage limitation principle in Law No. 27 of 2022 on Personal Data Protection ("UU PDP"): we keep personal data only for as long as needed for the purposes for which it was collected, or as required by law.
1. Principles
- Your records are yours. We never automatically delete your transactions, budgets, categories or money sources. They stay until you delete them or close your account.
- Operational data is time-limited. Logs and technical records that we keep for security, support or accounting are deleted automatically on a schedule.
- Keep only what is needed. We keep data for the shortest period consistent with its purpose, legal duties and the need to establish or defend legal claims.
- Deletion is real. When retention ends or you close your account, we delete the data from live systems; copies in rotating backups disappear when those backups expire.
2. Retention Schedule
2.1 Data you create
| Data | Retention | Deletion trigger |
|---|---|---|
| Account data (name, email, password hash, plan, timestamps, optional profile data) | While your account is open | Account closure |
| Transactions, transfers, recurring transactions | Until you delete them or close your account. Never auto-deleted | Your deletion or account closure |
| Categories, budgets, money sources | Until you delete them or close your account. Never auto-deleted | Your deletion or account closure |
| Receipt images and scan records | While your account is open | Account closure, or your request for deletion of scan data |
2.2 Operational and security data
The periods below are the current settings. They are maximum periods after which records are deleted automatically by a daily cleanup process. We may shorten them, and will update this policy if we lengthen them.
| Record | Purpose | Retention |
|---|---|---|
| Staff audit log | Accountability and security | 730 days |
| Billing verification log | Verifying purchases, accounting, disputes | 730 days |
| Sign-in events (time, outcome, device and IP) | Fraud prevention and account security | 400 days |
| AI usage logs (including the encrypted AI response) | Support, quality, abuse investigation, quota accounting | 400 days |
| In-app notifications | Delivering messages to you | 180 days |
| Failed sign-in attempt records | Brute-force protection | 7 days |
| Password reset tokens and email verification records | Resetting passwords and verifying email addresses | 30 days |
| Rewarded-ad confirmation tokens | Unlocking a Free plan scan | Short-lived; removed 7 days after expiry |
| Expired or revoked sign-in tokens | Session security | Removed 30 days after expiry or revocation. Active sign-ins expire after 180 days of inactivity |
| Registered devices and security events | Device recognition and anomaly alerts | While your account is open |
| Subscription records | Managing paid access | While your account is open; see the billing verification log above for the post-closure record |
| Support emails | Handling your request | As long as needed to resolve the matter and any follow-up |
Merchant (brand) names on the shared merchant list contain no personal data and are kept as long as they are useful.
3. Account Closure
When you delete your account in the app, your account data, transactions, categories, budgets, money sources, receipt scan records and images, sign-in tokens, devices, sign-in events, security events and notifications are removed from live systems. Records that identify the event and are no longer linked to your account, namely the billing verification log, the staff audit log and AI usage logs, remain only for their periods in section 2.2. Details are in the Close Account Policy.
Google Play subscription records are held by Google under Google's own retention policies, and you must cancel any active subscription in Google Play yourself.
4. Backups
We back up our database once a day for disaster recovery. We keep only a limited number of the most recent backups, 14 by default, and older ones are deleted automatically. This means that data you delete, or an account you close, can remain in a backup for as long as that backup exists, which is currently up to about two weeks. Backups are held in a protected location that is not accessible from the public internet and are used only to restore the Service. They are not used for any other purpose. If a backup is restored, we re-apply deletions that were made after the backup was taken before the Service resumes.
5. Legal Holds and Legal Requirements
We may keep data longer than the periods above where we are required to by law, a court order or a competent authority, or where it is reasonably necessary to establish, exercise or defend a legal claim or to investigate suspected fraud or abuse. In those cases we keep only what is necessary, restrict its use and delete it once the need has ended. Where a request to delete your data conflicts with a legal duty to retain it, we will tell you what we are keeping and why, to the extent we are permitted.
6. Anonymised Data
We may keep non-personal or fully anonymised information, such as platform-wide counts of accounts or plan activations, for planning and security. This information cannot reasonably be used to identify you, and it is never derived from the content of your transaction records.
7. Your Controls
- Delete individual transactions, categories, budgets and money sources in the app at any time.
- Sign out of devices from the app to end their sessions.
- Export your transactions as a CSV file before you delete anything.
- Close your account in the app (Profile) to erase your data as described above.
- Request deletion or access by emailing arizu.team@gmail.com. We respond within 14 days, extendable once by a reasonable period with notice to you.
8. Reviews and Changes
We review these periods regularly. When we change them in a way that affects how long your personal data is kept, we will update this policy and notify you of material changes in the app or by email.
9. Contact
Questions about retention can be sent to arizu.team@gmail.com. General support is at arizu.team@gmail.com. Our address is Arizu Studio, Grand Depok City, Cluster Gardenia, Kota Depok, Jawa Barat, 16412, Indonesia.. See also our Terms and Conditions.