What we hold, and for how long
Everything we keep about people: why we keep it, who can see it and when we delete it. It's the same list we use when someone downloads or deletes their account, so it stays up to date.
Last changed October 21, 2026 · 215 kinds of information across 27 parts of the site
By area
| Part of the site | Kinds of information | Longest we keep any of it | The whole list |
|---|---|---|---|
| Tillyard itself | 29 | Kept, marked retired, when the holder leaves. | See all that Tillyard itself holds |
| Your sign-in | 6 | 30 days for a refusal; up to a year for someone waiting. | See all that your sign-in holds |
| Account | 5 | 24 months after the erasure; a request you took back, 24 months after you made it. | See all that Account holds |
| The Record | 7 | The life of the item; then 36 months as a marker with no name, title, school or reason. | See all that The Record holds |
| Tillyard Research | 12 | Drafts untouched for a year are deleted; declined or withdrawn papers are kept 24 months. | See all that Tillyard Research holds |
| Tillyard Résumé | 5 | Until you delete the copy, turn copies off or close your account, or after 24 months without a sign-in. A deleted copy leaves an empty marker for 30 days so your other devices hear of it. | See all that Tillyard Résumé holds |
| Tillyard House | 8 | 30 days after the visit ends. | See all that Tillyard House holds |
| Messages | 14 | Cleared twelve months after the message was sent. A message you take back loses its words at once. | See all that Messages holds |
| Build experience | 3 | Until the member deletes it or the account is erased | See all that Build experience holds |
| Study sessions | 4 | 400 days, or until you erase your account. | See all that Study sessions holds |
| Projects | 8 | While anyone on the team holds a line on The Record from it; otherwise 12 months after it is closed. | See all that projects holds |
| Student groups | 4 | 24 months. | See all that Student groups holds |
| Volunteer work | 3 | Kept while an entry names it; a row nobody names is deleted after 30 days. | See all that Volunteer work holds |
| Tillyard Guides | 1 | Until you take it off your shelf or close your account. | See all that Tillyard Guides holds |
| Safety | 16 | 7 years. | See all that Safety holds |
| Policies | 3 | Kept with the staff action log, for as long as Tillyard operates. | See all that Policies holds |
| The staff console | 22 | Seven years after the year it covers. The board removes it by its routine; the site does not delete it by itself yet. | See all that the staff console holds |
| Campus pages and sharing | 6 | 400 days after the sheet ends; your name comes off if you delete your account. | See all that campus pages and sharing holds |
| Tips | 1 | Closes by itself if nobody replies, and is deleted 12 months after it closes. | See all that Tips holds |
| Career | 9 | Kept until you change it or delete your account. | See all that Career holds |
| Challenges | 6 | A team whose findings were never published is deleted 12 months after the project ends. A team with published findings stays with its findings. | See all that Challenges holds |
| Grants | 10 | Kept as long as the proposal it is about. | See all that Grants holds |
| Interns | 7 | Kept for as long as the agreement could matter. The typed name is erased if you delete your account; the fingerprint and times stay. | See all that Interns holds |
| Library | 6 | Kept until you delete the list or your account. | See all that Library holds |
| Sponsors | 3 | Kept while the sponsor account exists; removed with it. | See all that Sponsors holds |
| Surveys | 6 | Kept until you delete the survey or your account. A draft you haven't changed for 12 months is deleted. | See all that Surveys holds |
| Teams | 11 | Kept while it is on. Turning it off hides you at once and the row is deleted 30 days later. Deleted when you delete your account. | See all that Teams holds |
These keep nothing of their own: the home page.
Cookies and browser storage
| Name | Kind | What it is for | How long it lasts | Why it is set |
|---|---|---|---|---|
| __Host-dv | Cookie | Lets us tell you when your account is used from a browser it has not been used from before. | 400 days. | Essential |
| __Host-flash | Cookie | Carries a one-time message, such as "Saved", to the next page. | Two minutes at most; removed when the message is shown. | Essential |
| __Host-jn | Cookie | Carries your answers from one step of joining to the next. | One hour at most; removed when you finish. | Essential |
| __Host-persona | Cookie | Marks a browser where a member of the site's staff is looking at the site as a demo account. | Two hours at most; removed when they return to their own account. | Essential |
| __Host-preview | Cookie | Remembers that you typed the preview code while the site is not open yet, so you are not asked again. | 30 days. | Essential |
| __Host-rc | Cookie | Shows your new recovery codes once. | Ten minutes; removed when you say you have saved them. | Essential |
| __Host-rf | Cookie | Remembers that sign-up was declined from this browser, so the same questions are not asked again straight away. | 30 days. | Essential |
| __Host-si | Cookie | Ties a sign-in code to the browser that asked for it. | About fifteen minutes. | Essential |
| __Host-sid | Cookie | Keeps you signed in. | Up to 180 days, or 60 days without a visit. | Essential |
| __Host-tp | Cookie | Holds the key for your authenticator app until you have typed in the first code that proves it works. | Fifteen minutes; removed when you finish. | Essential |
| __Host-ts | Cookie | Remembers, for a few minutes, that you have finished the first step of a two-step sign-in and still owe the second. | Fifteen minutes; removed when you finish. | Essential |
| __Host-wa | Cookie | Holds the one-time challenge while your device answers with a passkey. | Five minutes. | Essential |
| dirpass | Cookie | Lets a signed-out visitor make a small number of directory searches after one bot check. | 10 minutes. | Essential |
| hold-until | Browser storage | Holds notices back until a pot you are in the middle of has poured. | Until the pot pours or the tab is closed. | Essential |
| live-paused | Browser storage | Remembers that you paused live updates. | Until you resume or clear your browser's storage. | Essential |
| nu | Cookie | Remembers the count beside Messages for a minute or so, to save a lookup on every page. | About 90 seconds. | Essential |
| privacy | Cookie | Remembers what you chose about analytics and advertising cookies, so you are not asked on every page. | 180 days, then you are asked again. | Essential |
| theme | Browser storage | Remembers a light or dark theme chosen with the switch in the header. | Until you change it or clear your browser's storage. | Essential |
| ui | Cookie | Applies your reading settings (text size, movement, theme) before the page is drawn. | 400 days. | Essential |
| wb-<your member id> | Browser storage | The Workbench's own database in your browser (IndexedDB): your drafts stay on your device. | Until you clear it from the Workbench's settings page, tick the box on the signed-out page, or clear your browser's site data. | Essential |
| wb.device | Browser storage | Remembers whether you said this is your own device, and which Workbench databases this browser holds, so they can be cleared at sign-out. | Until you clear the Workbench's data or your browser's site data. | Essential |
| wb.session | Browser storage | Holds your Workbench drafts for one tab on a shared computer (session storage), so that nothing is left behind. | Until the tab is closed or you sign out. | Essential |
The Cookie and Storage Statement says what each one holds and how to clear it.
What we never hold
- A date of birth.
- A government ID.
- A photo, voice or video of you.
- Card or bank details.
- Your precise location.
- Your race, religion, health or orientation as a stored field.
The site is built so that it has nowhere to store these.