Nore beta policy
Data retention schedule
Working implementation rules for data access, retention, deletion, and exceptional preservation during the Nore Public Alpha.
This text is an implementation draft and requires human and legal review before public launch.
Policy status
Effective date: 2026-07-27. Last updated: 2026-07-30. Version: alpha-public-v1. English (United States) controls.
These are implementation limits and current deletion behaviors, not legally approved guarantees. Rows marked for review remain G1 blockers.
Data retention schedule
| Data class | Purpose and access | Working retention rule | Deletion or preservation behavior | Review state |
|---|---|---|---|---|
| Account identity | Account access and recovery; user plus restricted operators. | Retained while active and during the exact 30-day recoverable-deletion grace. Public deletion email challenges expire after one hour and their minimized intake rows are purged within seven days. | Credential and direct identity are removed or anonymized by finalization; narrowly required audit/safety records may be preserved separately. | Implementation-bound; legal review pending |
| Age evidence | 13+ enforcement and teen default; server and verified support only. | Exact date of birth is retained while the account is active and through deletion grace. | Removed or anonymized at account finalization unless qualified legal review requires a narrower preservation record. | Implementation-bound; legal review pending |
| Profile and social graph | Profile presentation, privacy, follows, blocks, and mutes; audience selected by the user and authorized services. | Retained while active and preserved during the recoverable-deletion grace. | Direct identity is anonymized and eligible profile media is removed during finalization; block/safety integrity may require minimized records. | Implementation-bound; legal review pending |
| Public and audience-scoped UGC | Posts, Bits, blogs, clips, Watch, stories, comments, communities, public chats, and media; public or selected audience. | Retained while available and preserved during deletion grace; entity-specific soft-delete and media cleanup rules apply. | Eligible authored content/media is removed or detached at finalization, while report-linked evidence follows the safety schedule. | Partially specified; legal and provider verification pending |
| Private communications | DMs, groups, private attachments, and live participation; conversation participants and restricted reported-evidence operators. | Product messages follow conversation lifecycle. Report snapshots use 30 days after resolution or up to 90 days while open. | Eligible subject-authored media is cleaned at account finalization; third-party messages and legally sensitive evidence require separate review. | No final period approved; legal review required |
| Safety and moderation | Reports, cases, sanctions, appeals, evidence, and audit actions; trained least-privilege operators. | Public-text and quarantined-media evidence defaults to 14 days; private report snapshots use 30/90-day rules. Case/audit retention is not finally approved. | Evidence objects are purged by authoritative jobs; minimized cases, sanctions, appeals, and audit integrity may outlive ordinary content. | No final period approved; legal review required |
| Functional history and personalization | Saved items, reading/progress state, topics, preferences, and recommendation signals; user and product services. | Raw recommendation signals, observations, consumption sessions, slates, and target feedback are capped at 90 days. | The user can clear recommendation history separately; account finalization removes user-linked functional and recommendation records. | Implementation-bound; legal review pending |
| Optional analytics and aggregates | Opt-in Watch retention and aggregate product reliability; restricted product/engineering access. | Pseudonymous Watch playback-session HMACs expire within seven days; non-user-linked aggregate counts remain while the video exists. | Consent revocation stops future telemetry. Existing non-linkable aggregates cannot be deleted for one viewer; video hard deletion cascades its aggregates. | Implementation-bound; legal review pending |
| Operational and security records | Sessions, rate limits, job ledgers, security events, logs, and diagnostics; restricted engineering/security. | Implementation-specific expiries and cleanup jobs exist, but a single provider-aligned schedule is not yet verified. | Sessions are revoked on deletion request; logs and anti-abuse records use the shortest approved security period once legal/provider review is complete. | Partially specified; legal and provider verification pending |
| Transactional email | Verification, reset, and lifecycle messages; recipient plus restricted support/engineering. | Message contents are minimized; the provider metadata period still requires verification. | Nore removes account-linked records at finalization where controlled; provider-side delivery logs follow the reviewed provider schedule. | No final period approved; legal review required |
| Temporary data-rights export | Verified access/export fulfillment; authenticated subject and authorized operator through separate secure channels. | AES-256-GCM ciphertext expires exactly seven days after collection starts; a 30-minute authoritative sweep retries purge. | The R2 object and storage reference are removed; minimized request and audit metadata remain for process integrity. | Implementation-bound; legal review pending |