Data Retention Schedule ======================= Tillyard. Version 1.4. In effect from October 22, 2026. Fingerprint of this text (SHA-256): 4a9470a84220ac5b13568133eaa489b4712ddd2479097bfdee06fde4ec3c56ad This version: https://tillyard.org/policies/data-retention-schedule/v/1.4 - Every kind of record has a clock. Something starts it, it runs for a stated time, and then the record is deleted, blanked or reduced to a count. - Much is short-lived: a coffee ring lasts 24 hours, table chat 14 days, an unkept visit to the Shop 30 days, private notes up to 12 months. If you take a note back, it goes from the conversation at once. A copy is kept for 14 days in case the note is reported, and is then deleted. When your account is erased, the text of your notes is removed. - Your date of birth is never stored. Raw IP addresses are not kept in our database. - When you close your account you are hidden at once, you have 14 days to change your mind, and then your data is erased, usually in a day or less. - A few things outlive an account, each for a stated reason: case files, the record of what you agreed to, a scrambled copy of your email address, and nameless markers for old record links, each for a stated time; and the staff action log, which holds identifiers only, cannot be edited or pruned, and is kept for as long as Tillyard operates. - A legal hold or a legal duty to preserve stops the clock, but only for the records it covers. - Backups lag behind. A deleted record can persist in a backup for up to 12 weeks. If this summary and the full text below ever differ, the full text governs. 1. How to read this schedule ============================ 1.1 What this schedule is ------------------------- This schedule lists every kind of record Tillyard keeps that contains personal information, with what starts its clock, how long it runs and what happens at the end. Tillyard is an Ohio nonprofit corporation; "we" and "us" mean Tillyard. The Privacy Notice explains what we collect, why and who sees it. For how long a record is kept, this schedule is the more specific document and it governs. Section 37.5 of the Terms of Use sets the order among all our documents, including the sections of those terms that prevail over every other document. Some other policies repeat a period from this schedule for convenience. They are meant to match; if one ever differs, this schedule governs, except where a law sets the period. 1.2 The columns --------------- - Record: what is kept. - Clock starts: the event the period is counted from. - Kept for: the longest the record is kept in ordinary running. - At the end: what happens to it. Each row has a reference, such as A7, so it can be cited. 1.3 Words used here ------------------- Words that have one meaning in every one of our documents, such as member, visitor, staff, the editor, record item, hold, case and tip, are defined in Definitions. The words below are added for this document's own subject, or repeated from Definitions for convenience. If a repeated meaning ever differs, Definitions governs the meaning of the word. - Deleted means removed from the live database. - Blanked means the personal fields are emptied and the row stays, so that other records which point to it still make sense. - A tombstone is the nameless marker left where a public page used to be, so that an old link says "no longer listed" and does not simply fail. - Reduced to a count means only a total is kept, with nothing that identifies anyone. - A keyed hash is a one-way scramble made with a secret key that only our servers hold. It is still personal information and is listed here like any other. - A case is the file staff keep when something is reported, flagged, disputed or appealed. - The staff action log is our append-only record of what staff and automated rules did. It holds identifiers and reasons, never names or member text. - A legal hold is a written decision to keep specific records past their normal time because of a legal claim, an investigation or a legal duty (section 17). - Survives closure marks a record that is kept after the account it relates to is erased. 1.4 Periods are ceilings ------------------------ Each period is the longest we keep the record in ordinary running. Many records can be deleted sooner by you, and section 2.1 says which. 2. Rules that apply to every row ================================ 2.1 You can often delete sooner ------------------------------- You can delete your own notes, a draft paper, a self-reported Record item, a house-question answer, a kept receipt, account copies of Workbench documents, and your interests and profile text at any time. Closing your account erases everything not marked "survives closure". 2.2 Clean-up runs in batches ---------------------------- Deletion is done by scheduled clean-up that runs at least once a day and does a limited amount of work each time, so the site stays within its daily limits. A record whose time is up is removed on a following run, usually in a day or two, and later if that day's limits are reached. Where a row gives a period in hours or minutes, the record stops being shown at that time even if the row itself is cleared a little later. 2.3 Open cases -------------- A record that is evidence in an open case is kept with the case until the case closes, whatever its own row says. It then follows the row for that kind of case in section 10. 2.4 Copies made for a case follow the case ------------------------------------------ When something is reported, the system copies the reported item and its surroundings into the case. The original still follows its own row. The copy follows the case's row. That is why a line of table chat disappears from the room's log after 14 days while a reported exchange remains in its case file for longer. 2.5 Legal holds and legal duties -------------------------------- A legal hold, a lawful preservation request, or a law that requires us to keep something overrides the period for the records it covers, and for no others (section 17). 2.6 Backups ----------- Every period here describes the live database. Backups keep older copies for a limited time (section 15). 2.7 Counts without names ------------------------ Totals that identify nobody, such as how many pots were brewed on an evening or how many emails were sent on a day, are not personal information. We keep them without a time limit to understand how the site is used and what it costs. 2.8 Months and days ------------------- A period in months runs from the starting event to the same date that many calendar months later. "Days" are calendar days. 3. Accounts, sign-in and settings ================================= Accounts, sign-in and settings. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- A1 | Account record: your name, college email address, school, the date you joined, the date of your last email check, the time the 18+ check was done, the account's status, the last day you used the site, and your founding number if you have one. The last day is never shown to other members; it is used to decide whether to send the weekly letter and when unused Workbench copies lapse | You close the account, staff erase it, or a removed account reaches row A19 | While the account is open, then the closing period in row A20 | Name, email address and school are blanked. A blank row with an internal identifier stays so that other records still make sense A2 | Date of birth | Not applicable | Not stored. It is evaluated at sign-up and discarded in the same step | Nothing to delete A3 | Your answer to the status question at sign-up (undergraduate, graduate or recent graduate) | Sign-up | While the account is open | Deleted with the account A4 | A declined age check: a cookie in that browser, and a keyed hash of the email address used | The sign-up is declined | Up to 30 days | The cookie expires and the hash is deleted. No birth date is kept at any point A5 | A sign-up that was started and never finished: the email address entered and the code sent | The code is sent | Until the code expires, and no more than 24 hours | Deleted. No account exists A6 | One-time codes, kept in scrambled form | The code is issued | Valid for about 10 minutes. Cleared no more than 24 hours after being used or expiring | Deleted A7 | Sessions: a scrambled session token, when it was created and last used, how you signed in, a device label, and a keyed hash of the IP address the session was opened from | Sign-in | Until you sign out or sign the device out. Otherwise 60 days without use or 180 days in all, whichever comes first | Deleted A8 | Passkeys: the public key, its identifier, a label, the kind of device, whether the passkey is synced, a use counter and when it was last used | You add the passkey | Until you remove it or the account is erased | Deleted A9 | Account events: a new device, a passkey added or removed, a name or address change, the yearly email check | The event | While the account is open | Deleted with the account A10 | Consent records: each agreement or permission, the version of the wording you saw, when you agreed and when you withdrew | You agree or withdraw | While the account is open, then 24 months after it is erased. Each agreement to a document is also written to the staff action log (row H19) as an identifier, the documents and versions, a fingerprint of the wording and the time, and that entry is kept for as long as Tillyard operates | Deleted. Survives closure. The log entry stays A11 | Settings: time zone, notification choices, display settings, who may nod to you, and which notices of a small correction to a document you put away | You set them | Until you change or clear them, or the account is erased | Overwritten or deleted A12 | Interests | You pick them | Until you change them or the account is erased | Deleted A13 | Public-profile text and your per-field visibility choices | You write them | Until you change them or the account is erased | Deleted A14 | Former names: the old and new name in the record of a name change | The change is applied, declined or cancelled | 12 months | Both names are blanked in the change record. The row is deleted with the account A15 | A request to change your school email address | The change is applied, cancelled or lapses | 30 days | Deleted A16 | The weekly-letter schedule | You switch the letter on | While it is on | Deleted when you stop it A17 | Data export log: that an export was started, when, and how many parts it had. The export itself is put together in your browser and is never stored on our servers | You start an export | The export stays open for 30 minutes. The log row is kept 90 days | Deleted A18 | Connections, mutes and the blocks you placed | Created | Until you remove them or the account is erased. Nods are in row C5 | Deleted A19 | An account removed by staff | The removal decision | 12 months, unless the member closes the account sooner | Erased as in row A1, with no closing period A20 | The closing period | You confirm that you want to close | 14 days. Longer only while the closure is on hold (section 17) | The erasure run starts and usually finishes in a day or less A21 | Departure record: identifiers and dates showing that erasure ran | Erasure finishes | 24 months | Deleted. Survives closure A22 | A keyed hash of the email address of an erased account | Erasure finishes | 90 days if the account was in good standing. 24 months if other members had blocked it or a report about it was open. 36 months if staff had removed it | Deleted. Survives closure A23 | Blocks that other members placed on you | They block you | Until they unblock you or their own account is erased. Remembered against row A22 after you leave | Deleted A24 | Notices in the app | The notice is created | 90 days | Deleted A25 | How you arranged your home page, and cards you put away | You arrange it | Until you change it. A put-away card comes back after 90 days | Deleted with the account A26 | The link between a new member and the code on the join link or printed sheet they came through. The code names a place or a kind of page, never a person | You join | Up to 30 days | Deleted. Only daily totals for the code remain (row E12). Invitation links to a scheduled table are in row E7 A27 | The titles ledger (our software calls it the credentials ledger) and the perks ledger, including a founding number | An entry is made | While the account is open | Titles are retired and perks deleted when the account is erased. A founding number is retired and is not given to anyone else. The staff action log keeps the identifiers A30 | The editor's signed statement behind a title: what was signed, for whom and on what basis | The title is signed | While the title stands, then 3 years after it is withdrawn or retired. If the account is erased, the editor's sentence is blanked at once and a row with no name remains as a count | Deleted at the end of the 3 years. Blanked at erasure A28 | Interest you registered in something that is not open yet, such as the research cohort, with your answers | You register | Until you withdraw it or the account is erased, and no more than 24 months untouched | Deleted A29 | Accounts that go quiet | Not applicable | No automatic deletion at present. Rows D1 and G3 still apply | See the Privacy Notice, section 16.6 4. The Shop =========== The Shop. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- B1 | Table chat | The line is sent | 14 days | The whole log for that day is dropped. Lines already copied into a case follow the case B2 | Outside call-link events at a table | The link is set or cleared | 14 days, with that day's chat | Dropped with it B3 | Presence: that you are in a room, and at which table | You enter the room | Until you leave and the room has handed over your visit summary, a matter of minutes | Deleted B4 | Visit record: when you arrived and left, your drink, your one-line status, pots finished and how long you studied | The visit ends | 30 days, unless you keep the receipt | Deleted. A kept receipt stays until you delete it or the account is erased. The length of the visit has already been added to your running total (row B16) B5 | Coffee ring | You leave the table | 24 hours | The ring stops being shown and its fields are cleared B6 | Stamp counts, postmarks and the mug | They are earned | Until the account is erased | Deleted B7 | Who shared your table, trade-card ticks and Fifteens | That evening | 30 days | Deleted. A connection made by trading cards stays as a connection (row A18) B8 | Thanks given and received | The thanks is given | 180 days | Deleted B9 | House-question answers | You post the answer | 120 days, or until you rub it out | Deleted B10 | Favors | The offer is posted | An open offer lapses after 14 days. An accepted favor that is never finished lapses after 21 days. A finished favor is kept 12 months | Deleted. If you leave first, a finished favor stays in the other person's history without your identity B11 | "Coming tonight" (RSVP) | That evening | 7 days after it | Deleted B12 | The Morning Edition | It is published | 30 days | Deleted. Your name is removed sooner if your account is erased B13 | Your Shop preferences and opt-ins | You set them | Until you change them or the account is erased | Deleted B14 | Evening totals: orders, people, campuses and pots, with no names | Not applicable | No limit | Not personal information B15 | A study room a member opened: its name, what it is for, its topics, who may come in and its hours | The room is opened | Until the member closes it or erases the account. A room nobody visits for 14 days closes by itself | Closed and no longer listed. The row is deleted when the member erases the account B16 | Your running study-time total: one number, added to when a visit ends | A visit ends | Until the account is erased | Deleted B17 | The house total of study time: everyone's added together, with no names | Not applicable | No limit | Not personal information. It stays when a member leaves 5. Messages and threads (private messages) ========================================== Messages and threads (private messages). Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- C1 | Private notes and messages in group threads: sender, text and time | The message is sent | Up to 12 months. Sooner if you take the message back or your account is erased | Deleted. When you take a message back, or when your account is erased, its text is removed at once for everyone in the conversation, and the conversation shows only that a note was there. A copy taken into a case follows the case C2 | A kept copy of a note you edited or took back | The edit or the taking back | 14 days | Deleted. It is kept that long only in case the note is reported C3 | A note waiting to be delivered, or held by screening and never delivered | The note is sent | Until it is delivered. A held or refused note, 14 days after it is decided or lapses | Deleted. A copy taken into the case it opened follows the case C4 | Conversations and threads: who is in them, thread names, read marks, your mute and pin choices, and invitations | Created | Until nobody is left in the conversation. A closed thread, 30 days | Deleted. When you leave or your account is erased, your seat shows only that a member left C5 | Nods and introductions: who nodded to whom or introduced whom, when, and where they met | Sent | An unanswered nod lapses (currently after 14 days). The record is kept 180 days after it lapses or is answered | Deleted. A connection that came of it stays as a connection (row A18) C6 | Reactions to a note | You react | With the note | Deleted with it C7 | Your private memos about a connection, follow-up dates, your away line and your Notes settings | You write or set them | Until you change them, the connection ends or the account is erased | Deleted C8 | Calls between connections: who called whom from which conversation, who was rung, who answered, and when each person joined and left the call. Never any sound: calls are not recorded | The call starts | Up to 12 months, as for notes. Sooner when your account is erased | Deleted. When your account is erased, your part in each call is deleted at once. A copy taken into a case follows the case 6. Tillyard Research =================== Tillyard Research. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- D1 | A draft that has not been submitted | The last edit | 12 months untouched. A warning is sent at about 11 months | Deleted, with its versions and sources D2 | Draft history: saved versions, counts of typing and pasting, and the record of each paste (when, how long, and the pasted words up to 2,000 characters) | The final decision on the paper | Thinned to 8 versions at the decision, then deleted 90 days later. For a draft never submitted, kept with the draft | Deleted. The published version is kept while the paper is published D3 | A submission that was declined, or withdrawn before publication | The decision or withdrawal | 24 months | Deleted D4 | Sources, the frozen sections, fingerprints and the checks report, and the figures of a submission | Submission | With the submission | Deleted with it D5 | A co-author invitation that was refused | The refusal | 30 days | Deleted D6 | Byline and licence record: your name and college as printed, the licence version and when you accepted it | Publication | While the paper is published | The byline is removed when the paper becomes a tombstone. Your acceptance of the licence is kept as a consent record (row A10) D7 | An offer to read that was declined or lapsed | The decline or lapse | 30 days | Deleted D8 | Readings: scores, reasons and source checks | The decision on the paper | 24 months | Deleted. If the reader's account is erased first, the reader's identity is blanked at once and the reading stays until this date D9 | Decisions, the editor's questions and your answers, and appeals | The decision | 24 months, or while the paper is published if that is longer | Deleted D10 | Published papers, correction and withdrawal notices, and Readers' Selection lists | Publication | Until the paper is withdrawn | The page becomes a tombstone showing the title, the volume and number and the notice, with no byline and no text. Tombstones are kept so that links keep working D11 | Reading-pool membership, your fields and your practice read | You join the pool | Until you leave the pool or the account is erased | Deleted D12 | DOI look-up cache: public reference details, nothing about who asked | The look-up | 6 months | Deleted D13 | A research proposal: the question, method, timeline, budget, where you will publish, and the team you list | Created | A draft, 12 months after the last change. A declined proposal, 12 months after the decision. A proposal that received a grant, seven years after the grant ends | Deleted. A proposal that received a grant is not erased when you delete your account, because it is a financial record D14 | A request to join a research team, what was written to the lead, and whether the person agreed to be named | The request | 12 months after it is declined or the person leaves the team, or until the project is deleted or the account is erased | Deleted D15 | Reviewers' scores and comments on a proposal, a declared conflict of interest or a recusal (a person stepping aside from reading or deciding it), the decision and the reasons written for the applicant | The decision | As long as the proposal they are about | Deleted with it D16 | A research grant: the amount, whether the name may be shown, the results link; and the signed grant agreement: the typed name, the drawn signature, the time, the account and a fingerprint of the exact text | The agreement is signed | Seven years after the grant ends | Deleted. Not erased when you delete your account, because it is a financial record and the signed agreement D17 | Grant spending and its receipts: the amount, the date, what it was for, and the photo or PDF if one was attached | The expense is entered | Seven years after the grant ends, with the receipts | Deleted, receipts first. Not erased when you delete your account D18 | Grant reports: progress and final | Sent | Seven years after the grant ends | Deleted D19 | Payments marked as sent for a grant | Marked | Seven years after the grant ends | Deleted. Not erased when you delete your account D20 | The list of people who may not apply for or receive a grant (trustees, officers, staff and their families), with an email address kept only as a coded fingerprint | The person is added | While the person is on the list, and 12 months after they are taken off | Deleted 7. Pursuits, scheduled tables, booths, organizations and service ================================================================ The documents for each of these areas repeat the periods that apply to it: the official rules of a round, the Hosting Terms and Disclosure Policy, the Projects and Collaboration Terms, the Organizations Terms and the Service and Volunteering Terms. They are meant to match this section. If one ever differs, this schedule governs. 7.1 Pursuits ------------ Pursuits. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E1 | A round entry: text, link, declarations and standing | Results are published. For a draft never entered, the last change | Entered text, 24 months after results. A draft never entered, 180 days without changes, after a notice | Entered text is blanked and the counts are kept. A draft is deleted E2 | Scores and reasons in a round, and the name you put down for a round | Results are published | Scores and reasons, 24 months after results. A scoring row that lapsed or was stepped aside from, 30 days. Names put down are deleted at results | Deleted E3 | A portfolio piece: text, link, declarations and sealed figures | The last change | While its Record item is active. Otherwise 24 months after the last change. A draft, 180 days | Deleted E4 | Looks: what a reader typed after opening a piece or its link | The look is returned | While the piece is recorded, then 24 months. An offer that was declined or expired, 30 days | Deleted. If the reader's account is erased first, the reader's identity is removed and what they typed stays until this date E5 | Your own dated logs | You write an entry | Until you delete it or the account is erased | Deleted E33 | Pursuits you keep on your page | You keep one | Until you take it off or the account is erased | Deleted 7.2 Scheduled tables and hosting -------------------------------- Scheduled tables and hosting. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E6 | A scheduled table or series: title, note, host and times | The table takes place, or is called off | A table that was called off or did not meet, 90 days. A table that met stays as a count for the people who sat at it | Deleted. If the host's account is erased, the title and note are blanked and the table stays as a count for the people who sat at it E7 | Seats, standby places, invitation links and questions for a table | The table takes place | 90 days | Deleted E8 | Attendance and the answers to the three feedback questions | The table takes place | 400 days | Deleted. Only term counts and totals remain E9 | A host's term counts | The term | While the host has an account | Deleted with the account E10 | A title request, with the brief the editor saw and the decision | The decision | 2 years | Deleted. Only counts remain in the staff action log E11 | Notices you asked for about a host or a table | You ask | Until you withdraw them. A one-time ask, 30 days | Deleted E12 | Printed sheets and their codes: who made a code, the place it names and its dates. Daily scan totals hold nothing about who scanned | The code ends | 400 days after the code ends. Daily totals, 24 months | Deleted E13 | The log of looks at public posts under the disclosure rule: member, outcome and month, with no post text and no addresses | The look | 3 years | Deleted 7.3 Projects and booths ----------------------- Projects and booths. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E14 | A project: name, aim, kind, field, write-up, links, milestones, declarations and counts | The project is closed or put away | While anyone holds a Record item that rests on it. Otherwise 12 months after it is closed or put away | Deleted E15 | Seats: the team agreement version each person accepted and when, plans, claims, results and choices | Created | With the project. An invitation or request that ended, 30 days | Deleted. Acceptance of the team agreement is also a consent record (row A10) E16 | The ledger: the day of each session, who sat, the pots, done lines and notes. How long each person sat is not kept | The session | With the project. A cancelled or empty session, 90 days. A line or note you delete goes at once | Deleted E17 | Help Wanted cards, and answers to them | The card comes down, or the answer ends | A card, 90 days after it comes down. An answer, 30 days after it ends | Deleted E18 | Your answers in "Who did what" (the blind confirmation) | The project is recorded | With the project (row E14) | Deleted. If your account is erased first, your identity is removed and the answers stay with the project E19 | Credit questions, and any note written for staff | The question closes | 24 months | Deleted E20 | Words between collaborators | Written | Until removed or withdrawn, or with the project | Deleted 7.4 Student organizations ------------------------- Student organizations. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E21 | An entry: name, kind, description, directory address, and who registered and confirmed it | Registered | While the entry exists. A closed entry's text, 24 months, or while a Record item refers to it. A registration nobody confirms, 21 days | Deleted E22 | The roster and the roll: who is on it, and a count and month of attendance | You join | Until you leave, are taken off, or the entry closes. A request to join, 14 days | Deleted E23 | Officer roles, their dates and who confirmed them | The role is claimed | While the holder has an account. A claim nobody confirms is removed after 21 days | Deleted. A confirmation given by someone whose account is later erased stays as a count without their name E24 | The meeting ledger: counts only | The meeting | 24 months | Deleted E25 | Notices and handover sheets | Written | A notice, 30 days after it expires. Sheets, the newest four | Deleted E26 | Disputes about an entry or a role, and decisions on them | The decision | 24 months | Deleted 7.5 Service ----------- Service. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E27 | Service entries and co-participants' parts: description, dates, link and the statements ticked | Created | A confirmed entry, until you remove it or the account is erased. A draft, or an entry sent back or lapsed, 180 days untouched, after a notice | Deleted, with the confirmations, parts and readings attached to it E28 | The outside confirmation behind an entry | The confirmation | See rows K2 to K5 | See those rows E29 | Your usernames on outside sites, and the codes that show an outside account is yours | You add them | Until you remove them or the account is erased | Deleted E30 | The readers' pool for links: your membership, and what you typed when you read one | You join, or return a reading | Membership, until you leave the pool. Your sentence, 24 months. The values that were compared, for the life of the item they support | Deleted. If your account is erased first, your name is removed and the compared values stay E31 | Help-table tallies: counts, and scrambled markers of the members who were helped | The term | Counts, for the life of the item. Markers, 12 months after the term | Deleted E32 | The shared list of organizations, and the link to who added each one | Added | The organization stays on the list. A row nobody used, 30 days | The link to the member who added it is removed if that account is erased 7.6 Learning teams ------------------ Learning teams. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E34 | An application to join a learning team for a term: why you want to take part, what you built, your state, your team choices | You apply | A declined application, 90 days after the decision. Any other, 12 months after the term ends | Deleted E35 | Your place on a team: the team, what you want to learn, your duties and the ticks against them | You are accepted | 12 months after the term ends, then the plan text is cleared | Plan text cleared; the dates stay as a count E36 | Weekly notes you write for your lead and the program director | You write the note | 12 months after the term ends, or until the account is erased | Deleted E37 | Hours you write down yourself, for a school that may give credit. Nobody checks them | You add a line | 12 months after the term ends, or until the account is erased | Deleted E38 | The signed agreement and learning plan: the name typed, the time, the account, and a fingerprint of the exact text | Each signature | For as long as the agreement could matter | The typed name is erased if the account is erased; the fingerprint and times stay E39 | A volunteer team lead's invitation and answer | The director asks | 12 months after the term ends | Deleted E43 | A member's request to be emailed once when applications open for a term on a team | The member asks | 12 months, or once we have written to them, or when they take themselves off the list | Deleted 7.7 College pages, founding numbers and invitations --------------------------------------------------- College pages, founding numbers and invitations. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E40 | A founding number: the number, the college, which first act earned it, and when | The act is counted | While the account lives | The name is removed and the number stays, so a number is never given twice E41 | An invitation you made to one table: its code, the table it points at, and whether it shows your name. Nothing is kept about who opens it | You make it | Until you end it or the table has met, and no more than 90 days after | Deleted E42 | A college page: a count of members, and the rules of the founding window as they were when it opened. Totals only | The college has members | While the college has members | Deleted 7.8 Sponsored projects ---------------------- Sponsored projects. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- E44 | A team on a sponsored project: its name, its short note and who leads it | Created | A team whose findings were never published, 12 months after the project ends. A team with published findings stays with its findings | Deleted E45 | Your place on a team: that you are on it, whether you lead it, whether you chose to be named, and when you agreed to the official rules | You join | Until you leave, the team is deleted, or you delete your account | Deleted. Your name stays off public pages unless you ticked the box to be credited E46 | A request to join a team, the line you wrote to the lead, and an invitation to you | Sent | 12 months after it is answered or taken back, or until the team is deleted or the account is erased | Deleted E47 | Findings sent for a sponsored project, and the team lead's agreement to license them under CC BY 4.0 | Sent | Published findings stay on the project page under the licence. A draft or withdrawn finding, 12 months after the project ends | Deleted. When you delete your account your name comes off the credit and the findings stay E48 | Your choice to put the home page banner for a project away, for now or for good | You choose | 30 days after the project ends, or until you delete your account | Deleted E49 | A sponsor's contact: a name, an email address that is stored sealed, and the line winners are told for arranging a prize | The project is made | 12 months after the project ends | Cleared. A project's own record (the question, criteria, prizes, winners and the reasons) is the organization's record and holds no student's name 8. The Record ============= The Record. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- F1 | Record items approved by the editor or staff, and items recorded by the system, members or an outside party | The item is created | The life of the item | If the item is withdrawn, its page reads "withdrawn". If the account is erased, the page becomes a tombstone (row F3) F2 | Self-reported items | You add the item | Until you remove it or the account is erased | Deleted F3 | Tombstones for record pages: the page address, its code, its last status and the month, with no name, title, school or reason | The account is erased | 36 months | Deleted. The address then answers "nothing is listed here". Survives closure F4 | Your public page and its settings | You switch it on | Until you switch it off or the account is erased | Deleted F5 | Your directory entry: name tokens and school | You are listed | Only while you are listed | Deleted at once when you opt out, when the page is held, or when the account is erased F6 | Directory searches | Not applicable | Not logged | Nothing to delete F7 | A signed-out visitor's search pass | The pass is issued | 10 minutes | Lapses F8 | Open counts: daily totals for each item, with nothing about who opened it | The day | 400 days | Deleted F9 | The "name updated" note shown on your pages after a name change | The change | 12 months | Removed F10 | Skills linked to an item | You link them | The life of the item | Deleted with it F11 | A link or code typed into the "check a record" box | Not applicable | Not stored or logged | Nothing to delete 9. The Workbench and The Almanac ================================ The Workbench and The Almanac. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- G1 | Documents, snapshots and practice results kept in your browser | Not applicable | On your device. We do not hold them | You clear them, or your browser does G2 | A résumé file you import | Not applicable | Not stored anywhere. It is read in your browser and released | Nothing to delete G3 | Account copies of your documents, your tracker, or both | You switch copies on | Until you delete them, switch copies off or close the account, or after 24 months without a sign-in | Deleted. A deletion marker is kept 30 days so your other devices learn of it, then removed G4 | The anonymised copy of your résumé in the swap | Your swap entry closes | 30 days | Blanked G5 | Notes written in a swap | The notes are delivered, or the swap ends without delivery | 12 months if delivered. 30 days if never delivered | Deleted. If the writer's account is erased first, the writer's identity is blanked and the notes stay until this date G6 | Swap pairing history, used to avoid pairing the same two people again | The swap ends | 12 months | Deleted G7 | A bar from the swap set by staff after a report | The decision | Until staff lift it | Deleted. The case behind it follows section 10 G8 | The Almanac: guides and entries you saved, read or put away, reminders you asked for, a signal that a link did not open, your chosen fields and your notice switch | You save, mark or set it | Until you remove them or the account is erased. Marks on an entry we have retired, 30 days after it is retired | Deleted G9 | The details you type into a letter or email template in The Almanac: your name, school, year and field | Not applicable | On your device only. They are never sent to us | "Forget these", signing out and closing your account clear them 10. Safety, cases and legal records =================================== Safety, cases and legal records. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- H1 | Reports: who reported, the category and what they wrote | The report | With the case | Follows rows H3 and H4 H2 | A hold on an item | The hold | Until it is released or the case is decided | The item is shown again or removed. The record of the hold stays in the case H3 | A case closed with no action | The case closes | 12 months | Deleted. Survives closure H4 | A case in which action was taken | The case closes, or any appeal ends | 24 months where the outcome was a notice, a mute, a suspension or a withdrawn item. 36 months where an account was removed | Deleted. Survives closure H5 | Strikes | The decision | A strike counts for 12 months. Its record stays in the case | It stops counting, and is deleted with the case H6 | Evidence packets: the reported item and its surroundings, times, the room or thread, account ages, earlier report counts, screening results, and a keyed hash of the IP address with the browser type | The report | With the case. The hashed IP address and browser type are removed after 90 days | Deleted with the case H7 | Appeals and their outcomes | The appeal | With the case | Deleted with the case H8 | The screening verdict and reasons | The screening | With the item screened or the case it opened, for as long as that is kept. No separate store of scores is kept | Deleted with the item or the case H8a | Text waiting to be re-checked because a safety service was unavailable: the text and the writer's identifier | The check could not be completed | Until it is checked, normally minutes, and never more than one day | Deleted when a verdict returns or the last attempt is made. Cleared at once if the writer's account is erased H8b | The deny list: a one-way fingerprint of a link or text removed under an upheld removal request, used to find exact copies and to hold any later message that contains it | The request is upheld | With the removal request it came from (row H10), 5 years | Deleted with the request H9 | Safety signals that did not lead to a case | The signal | 30 days | Deleted H10 | Intimate-image removal requests: the request record and the hidden copy of the removed text | The ticket closes | 5 years, as the Intimate-Image Removal Policy also states | Deleted. Once the ticket is closed you can ask us to delete your contact details sooner H11 | Material we reported to the National Center for Missing and Exploited Children | The report is submitted | One year from the report, as federal law requires, and longer where the law requires it. See the Child Safety Policy | Deleted. Until then it is kept in a restricted place, with access limited to what the law requires H12 | Copyright notices, counter-notices and repeat-infringement records | The matter closes | 3 years | Deleted H13 | Disputes and correction requests, including a withdrawn outside confirmation | The dispute closes | 24 months | Deleted H14 | The refund and bank-dispute log: ticket, date, amount and outcome, never card details | The entry | 7 years | Deleted H15 | An account closed because the member was under 18, and the record of an age re-check | The decision | The account is erased at once, with no closing period, unless a legal hold or a duty to preserve covers it. The record of the re-check and the case, with no birth date in either, 36 months | Deleted. Anything the law requires us to preserve follows row H11 H16 | Legal requests we receive (subpoenas, warrants, court orders, preservation requests) and our replies | The matter closes | 6 years | Deleted H17 | Records kept because of a lawful preservation request | The request arrives | For as long as the request lawfully requires, normally 90 days and a further 90 if renewed | The records go back to their normal rows H18 | The register of legal holds: what was held, why, who decided and when | The hold is released | 6 years | Deleted H19 | The staff action log, including staff views of member data, uses of the view-as tool, decisions made by a standing rule, and an entry for each agreement to a document | The entry | For as long as Tillyard operates. It holds identifiers and reason keys, never names, email addresses or member text | Not deleted: the table refuses any change or removal, including by the owner. Survives closure. Once an account is erased, nothing in the live database connects its identifier in the log to a name or an address H20 | A keyed hash of the name and college of an account that staff removed | The removal | 24 months | Deleted. It can only raise a flag for a person to look at, and a flag closes by itself after 30 days. Survives closure H21 | Staff notes about a member: facts written down so that one case can be read in the light of another | The note is written | 24 months from the day the note was written, and never past the erasure of the account | Deleted. Staff notes are not in your export, because they may name other people; ask at legal@tillyard.org and the owner will send them with other people's details removed H22 | The log of requests about a person's own information (to see, correct or delete it): who asked, in a few words, and that it was handled | The request closes | 3 years | Deleted. The correspondence itself follows row J4 11. Technical and security records ================================== Technical and security records. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- I1 | IP addresses in readable form | Each request | Not stored in our database. Our network provider processes them to deliver and protect the site | See row I5 for the provider's logs I2 | A keyed hash of your IP address in a rate counter | The request is counted | Until the counting window ends, which for most limits is an hour or a day. Never more than 30 days | Deleted I3 | A keyed hash of the IP address, and the browser type, attached to a report, a public-form submission or an evidence packet | Captured | 90 days in a report or an evidence packet. 30 days on a public-form submission | Removed from the record. The rest of the record follows its own row I3a | A keyed hash of the IP address a sign-in session was opened from, kept with the session (row A7). It is compared between accounts to notice when two appear to share a network before one is offered the other's work to read or score | Sign-in | Until the session ends: 60 days without use or 180 days in all, whichever comes first | Deleted with the session I4 | The master secret from which every key used for keyed hashes and sealed fields is derived | Not applicable | Kept for as long as the site runs. We replace it only after a suspected compromise | Hashes made before a replacement stop matching: IP hashes, the do-not-email list (row J3), the departed-account and returning-member hashes, and the sealed contact details on removal requests. The internal key-rotation procedure says how the do-not-email list is carried across I5 | Request logs kept by our hosting provider: time, address requested, response code, timing and network details | Each request | A few days, set by the provider's plan. Never more than 7 | Deleted by the provider I6 | Rate and budget counters kept against a member or a session | The action is counted | Until the window ends. The longest window is 30 days | Deleted I7 | Bot-check results | The form is submitted | For that one request | Not stored I8 | Signed tickets and links: a room ticket, an unsubscribe link, a status link for a ticket | Issued | A room ticket, 20 seconds. Others, for the life of the thing they point to | They lapse. Tickets and links are checked by their signature and are not stored I9 | Daily totals for requests, database use and email, with no personal information | Not applicable | No limit | Not personal information I10 | Cookies and browser storage | See the Cookie and Storage Statement | See the Cookie and Storage Statement | See the Cookie and Storage Statement 12. Email and correspondence ============================ Email and correspondence. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- J1 | Daily counts of the email we send in each class (essential, notice, optional). Nothing about who received it, and no body | The email is sent | Kept as totals | Not personal information J2 | Delivery records kept by our email provider | The email is sent | As the provider's plan sets | Deleted by the provider J3 | An unsubscribe, or a "never email this address again" request. For someone who is not a member, kept as a keyed hash | The request | Until the person lifts it | Kept so that we can honour it. Deleted if lifted J4 | Email you send to our addresses: support, legal, security, accessibility, press | The last message in the conversation | 24 months | Deleted from the company's mailbox. Longer if it is part of a case or a legal matter, which then follows that row J5 | Larger-support and sponsorship inquiries sent through the form | The inquiry is closed | 12 months | Deleted J6 | Urgent alerts sent to the president's phone: counts of waiting items, due times, case and reference numbers, and check values from the staff action log. No names, email addresses or member text | The alert | As the alert service keeps them | Not personal information about members 13. People who are not members ============================== People who are not members. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- K1 | Visitors | Not applicable | No record names a visitor. See rows F8, I1 and I2 | Not applicable K2 | An outside confirmer's name, role and email domain, as shown on a Record item | The confirmation | For the life of the item. If the confirmation link lapsed or the confirmer declined, 90 days | Removed when the confirmation is withdrawn, the item is removed or the member's account is erased. A tombstone carries no names. The confirmer's email address itself is not kept K3 | A keyed hash of the outside confirmer's email address, and a yes or no on whether the answer came from the same network as the member's | The confirmer answers | 24 months after the answer | Deleted K4 | The one-time code sent to an outside confirmer | The code is issued | As row A6 | Deleted K5 | A confirmation that was withdrawn or disputed by the confirmer | The withdrawal | As row H13 | Deleted K6 | The name of a non-member in something a member wrote | Not applicable | With that item | Hidden at once on a qualifying request (see the Privacy Notice, section 3.13). Deleted with the item K7 | A waiting-list entry: your college email address and a keyed hash of it | You leave your address | Until we send the one email saying you can join. Never more than 12 months | Deleted. The hash stays only if you asked not to be written to again (row J3) K8 | A request to add a school to the list: the ending of its addresses, the college name as first typed and how many people asked. No email address and no IP address is kept in this row; the people who asked are in row K10 | The request | The name is blanked when the request is decided. The row, 12 months | Deleted K9 | A request from a non-member about their own information, and a report made from a public page by a visitor | The request or report is closed | The correspondence and the report, 24 months. The log that the request was handled, 3 years (row H22) | Deleted K11 | An early-list entry: your email address, kept encrypted, a keyed hash of it, its domain and the date | You leave your address | Until we send the one email saying you can join or that donations are open. Never more than 12 months | The address is deleted. The hash stays only if you asked to be taken off, so it is not listed again K12 | A demo-link visit: a random id for the browser, the link, the device kind, the role the guest tapped if any, and the pages opened and things tried, with times. No name, email or network address | The guest's last visit | 12 months | Deleted K13 | A request for a new demo link: name, email address, role, organization and message | The request is answered | 12 months | Deleted K10 | The people who asked for a college to be added: email address, the college's name, the city and state they typed and a note if they wrote one. No IP address is kept with it | The request | Until the request is answered, and never more than 60 days. If the college is added, until the one email telling you has gone, 14 days at most | Deleted. A request that is turned down, or is for a college already on the list, is deleted at once 14. Tips, larger payments and business records ============================================== Tips, larger payments and business records. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- L1 | A record of a tip on our own site | Not applicable | None exists. The site stores nothing about tips or tippers | Nothing to delete L2 | Payment records in the company's Stripe account: payer name, email address, amount, date and the limited payment details Stripe shows a business | The payment | Stripe keeps its records under its own rules. Copies we take for bookkeeping and tax are kept 7 years | Deleted from our files L3 | Written agreements for larger payments and sponsorships, and the invoices for them | The agreement ends | 7 years | Deleted L4 | The refund and bank-dispute log | See row H14 | See row H14 | See row H14 L5 | A sponsor account: the organization's name, the contact's email address and how it signs in, and which sponsored projects and grant rounds it is linked to | The account is closed | While the sponsorship lasts. The account stays as long as it has a gift on record (row L7) | Links deleted with the account. The account is switched off, or deleted if it never gave L6 | A sponsor's API keys: a keyed hash, the last four characters and a label | The key is revoked | Kept, revoked, while the account exists, so the log stays whole | Deleted with the account L7 | A gift started through a sponsor's page or the payments API: amount, fee covered, purpose, the name the giver typed, Stripe's checkout reference and whether it was paid. No card details | The gift | 7 years | Deleted 15. Backups =========== Backups. Columns: ref, record, clock starts, kept for, at the end. Ref | Record | Clock starts | Kept for | At the end --------------------------------------------------- M1 | The weekly copy of the database. Table chat is held in each room's own storage and is not in it | The copy is made, about once a week | No copy is kept longer than 12 weeks | Deleted by the owner as a weekly duty M2 | Rolling recovery copies kept by our hosting provider | Continuous | A period set by our plan with the provider, never more than 30 days | They roll off - A record you deleted, or that reached the end of its period, can persist inside a backup until that backup is deleted. - Nothing in a backup is shown to members, visitors or search engines, and staff do not look inside backups in ordinary running. - We do not restore single records from a backup to undo a deletion. - If the whole database ever has to be restored, we aim to re-apply the deletions, removals and holds made since that backup before the site reopens. 16. What outlives a closed account ================================== Everything not listed here is erased when an account closes. What outlives a closed account. Columns: what stays, why, how long, row. What stays | Why | How long | Row --------------------------------- A blank account row with an internal identifier | So that other people's records, such as a conversation or a reading, still make sense | While those records exist | A1 The dated record of what you agreed to | To show what was agreed | 24 months. The staff action log's entry for each agreement to a document stays as long as the log does | A10, H19 A departure record | To show that erasure ran | 24 months | A21 A keyed hash of your email address | So that leaving and re-joining does not undo a block or a removal | 90 days, 24 months or 36 months | A22 Your seat in a conversation, shown only as a member who left. The text of the notes you sent is removed | So the other person's conversation still reads properly | While the conversation exists | C1 and C4 A reading you wrote, without your identity | So the author keeps their feedback | 24 months after the decision | D8 A paper with co-authors, with your byline replaced by "a former member" | Because it is also the other authors' work | While it is published | D10 A tombstone for a paper you wrote alone | So links keep working | See row D10 | D10 Nameless tombstones for your record pages | So a link on an old résumé says "no longer listed" | 36 months | F3 Swap notes you wrote for someone, without your identity | So the other person keeps their feedback | 12 months | G5 A finished favor, without your identity | It is part of the other person's history | 12 months | B10 Case files that involve you | Other members' safety, and our ability to answer a later complaint | 12, 24 or 36 months | H3 and H4 A keyed hash of your name and college, if staff removed the account | To notice a removed person's return, for a person to look at | 24 months | H20 Teammates' records that rest on something you confirmed: your blind answers, your confirmation of an officer's role, a score or a look you gave, without your identity | So that another member's record does not fall because you left | As rows E4, E18, E23 and E30 say | E4, E18, E23, E30 Your founding number, retired | So that it is not given to anyone else | Without limit, as a bare number | A27 The staff action log, which holds identifiers and reason keys and never names, email addresses or text | So decisions can be checked, and so that what was agreed can be shown | For as long as Tillyard operates | H19 The fact and date of any privacy request, removal request, copyright notice or dispute you sent us, with your contact details erased where the row says so | To show what was asked and what we did | As rows H10, H12, H13 and H22 say | H10, H12, H13, H22 The bare record of an age re-check, with no birth date | To show the check was done | 36 months | H15 A refund or chargeback entry in the payments log | Tax and accounting | 7 years | H14 A research grant and the proposal it came from, the signed grant agreement, its spending and receipts, and its payments | They are financial records, and the signed agreement | Seven years after the grant ends | D13, D16, D17, D19 A blanked row for a title the editor signed for you | Kept as a count | With no name and no sentence | A30 Anything under a legal hold or a legal duty to preserve | The law requires it | Until released | Section 17 Older copies in backups | Recovery from a failure | Up to 12 weeks | M1 17. Legal holds =============== 17.1 What a hold is for ----------------------- A hold keeps specific records past their normal time. We may place one when: - a report in an urgent category involving an account is open and that account asks to close; - we have received a subpoena, warrant, court order or lawful preservation request that covers the records; - a legal claim involving the records has been made or is reasonably expected; - a law requires the records to be preserved, as it does after a report to the National Center for Missing and Exploited Children. 17.2 How a hold works --------------------- - Only the owner can place or release a legal hold. A hold on a closing account for an open case can be placed by the system and is reviewed by staff. - A hold names the records it covers and the reason. It covers those records and no others. - Held records are not deleted by clean-up. They are not shown anywhere they would not otherwise be shown, and a hold gives nobody new access to them. - A hold has no fixed length. Each open hold comes up for the owner to review at a set interval (currently every 90 days, and one year for a hold that follows a report to the National Center for Missing and Exploited Children). It is released when its reason ends, and the records then go back to their normal rows. If their time has already run out, they are deleted on the next clean-up. - Placing and releasing a hold are written to the staff action log, and the register in row H18 records each hold. 17.3 Telling the person concerned --------------------------------- If closing your account is on hold, the closing page says so, and you stay hidden in the meantime. We may be unable to say more where a court order or an investigation forbids it. 18. Records held by our providers ================================= The companies that work for us keep some records of their own. We choose their settings to keep as little, for as short a time, as their service allows, but their retention is theirs. Records held by our providers. Columns: provider's role, what it keeps, for how long. Provider's role | What it keeps | For how long ---------------------------------------------- Hosting and network | Request logs (row I5) and recovery copies (row M2) | Up to 7 days, and up to 30 days Bot check | The signals described in the Cookie and Storage Statement | As Cloudflare's terms provide Email delivery | Delivery records for email we send | As the provider's plan sets Text-safety classification | Whatever the provider's terms allow it to keep of text sent for checking | As the provider's terms provide Payments | The payer's details and payment records | As Stripe's terms and the law require of it Reference look-up | The DOIs our server asks about, with nothing about who asked | As Crossref's terms provide Urgent alerts | A case number and a severity level | As the alert service provides 19. Records on your own device ============================== Cookies, your theme choice and everything the Workbench keeps in your browser are on your device, not on our servers. They last until they expire, you clear them or your browser clears them. The Cookie and Storage Statement lists each one and says how to clear it. Closing your account does not reach into your browser; the closing page offers a button to clear the Workbench's data there. Anything you downloaded, printed or exported is yours to keep or destroy. So is any copy another person made of something you showed them. 20. How this schedule is kept accurate ====================================== - Each part of the site declares the personal information it stores, with a purpose and a period, in a data inventory. A copy of that inventory is included in every member's data export, so the export explains itself. - A new feature that stores member text or personal information is not finished until it has an inventory entry and a deletion routine that the account-closing process calls. - We aim to review this schedule at least once a year, and whenever a feature is added or a provider changes. - If you find a record kept longer than this schedule says, tell us at legal@tillyard.org. 21. Changes to this document ============================ The version number and effective date are at the top, and earlier versions stay available. Shortening a period, or adding a row for a new kind of record before that record is first collected, may take effect when published. If we propose to keep an existing kind of record for longer, we aim to tell members in the app and by email before the change takes effect, and the longer period applies only to records created after that date unless you agree otherwise. 22. Contact =========== - Questions about this schedule, or a request to delete something: legal@tillyard.org - Help using the deletion and export tools in your account: support@tillyard.org - Post: Tillyard, Privacy, 10602 York Rd SW, Etna, Ohio 43062