This policy defines how DeductionDog retains, deletes, and protects personal, financial, receipt, mileage, authentication, communication, analytics, logging, and backup data. It applies to services operated by Don Schomer III, sole proprietor doing business as DeductionDog, in collaboration with Vision Tax Co.
Retention schedule
| Data category | Retention |
|---|---|
| Account and profile | While active; deleted with the account unless legally required otherwise. |
| Ledger, bank transactions, receipts, assets, mileage, home-office records, and location history | While active or until the user deletes the record/account. |
| Plaid, Gmail, Microsoft, and IMAP credentials | Until unlink, revocation, provider invalidation, or account deletion. |
| Authentication sessions | Until expiration, revocation, security reset, or account deletion. |
| Used/expired password-reset and verification tokens | Normally removed within 7 days. |
| Finalized outbound email content | Scrubbed 30 days after final delivery, failure, cancellation, or suppression. |
| Email queue metadata and delivery/engagement events | Up to 12 months. |
| Consent-based product analytics | Up to 12 months. |
| Email suppressions | Until resolved or removal is required by verified request or law. |
| Container/application logs | Size-rotated locally; currently no more than five 10 MB files per container. |
| Daily encrypted database backups | Approximately 30 days. |
| Weekly encrypted database backups | Approximately 90 days. |
| Monthly encrypted database backups | Approximately 370 days. |
User deletion
Users may delete supported individual records and may permanently delete an account from Settings after password reauthentication and an explicit confirmation phrase. Live account deletion removes the user and cascades through associated PostgreSQL records. Stored receipt objects are deleted from private object storage before the live account is removed. Linked sessions and integrations are deleted or revoked.
Backup treatment
Backups are encrypted before leaving the VPS and stored in a private R2 bucket with credentials separate from receipt storage. Lifecycle rules expire daily, weekly, and monthly prefixes automatically. Backups are used only for disaster recovery and security investigation. If a backup is restored after a disaster, verified deletion requests and account status changes are reapplied where technically feasible.
Legal and security exceptions
Information may be retained when reasonably necessary to comply with law, preserve evidence, investigate fraud or security incidents, resolve disputes, enforce agreements, or protect users and the service. Exceptions must be limited, access-restricted, documented, and reviewed.
Provider deletion
Deletion timing at Plaid, Google, Microsoft, Apple, Namecheap, Resend, Cloudflare, Hostinger, Better Stack, or another provider may be subject to provider retention and legal obligations. DeductionDog revokes or deletes provider resources available through its integration and follows up on verified requests where needed.
Automated enforcement
- Delete product analytics and email events older than 12 months.
- Scrub finalized outbound email bodies older than 30 days.
- Delete terminal email queue metadata older than 12 months.
- Delete used or long-expired verification and password-reset tokens.
- Delete expired or old revoked sessions and stale rate-limit records.
Systemd timers create encrypted backup tiers, R2 lifecycle rules enforce expiration, and Better Stack/Resend monitor successful and failed execution.
Requests and review
Requests may be sent to support@deductiondog.com. Identity and account control may be verified. This policy is reviewed at least annually and after material retention, provider, legal, or architecture changes.