How particular things are handled

Data Retention Schedule

Version 1.3 · In effect from October 21, 2026

What changed

https://tillyard.org/policies/data-retention-schedule/v/1.3 · Fingerprint (SHA-256) 035779aedf926bd7e93ef00d47c16ab07562bd43d464f3701ab31bd345f73997

In short

Every kind of record has a clock. Something starts it, it runs for a stated time, and then the record is deleted, blanked or reduced to a count.
Much is short-lived: a coffee ring lasts 24 hours, table chat 14 days, an unkept visit to the Shop 30 days, private notes up to 12 months. If you take a note back, it goes from the conversation at once. A copy is kept for 14 days in case the note is reported, and is then deleted. When your account is erased, the text of your notes is removed.
Your date of birth is never stored. Raw IP addresses are not kept in our database.
When you close your account you are hidden at once, you have 14 days to change your mind, and then your data is erased, usually in a day or less.
A few things outlive an account, each for a stated reason: case files, the record of what you agreed to, a scrambled copy of your email address, and nameless markers for old record links, each for a stated time; and the staff action log, which holds identifiers only, cannot be edited or pruned, and is kept for as long as Tillyard operates.
A legal hold or a legal duty to preserve stops the clock, but only for the records it covers.
Backups lag behind. A deleted record can persist in a backup for up to 12 weeks.

If this summary and the full text below ever differ, the full text governs.

This schedule lists every kind of record Tillyard keeps that contains personal information, with what starts its clock, how long it runs and what happens at the end. Tillyard is an Ohio nonprofit corporation; "we" and "us" mean Tillyard.

The Privacy Notice explains what we collect, why and who sees it. For how long a record is kept, this schedule is the more specific document and it governs. Section 37.5 of the Terms of Use sets the order among all our documents, including the sections of those terms that prevail over every other document. Some other policies repeat a period from this schedule for convenience. They are meant to match; if one ever differs, this schedule governs, except where a law sets the period.

1.2 The columns

Record: what is kept.
Clock starts: the event the period is counted from.
Kept for: the longest the record is kept in ordinary running.
At the end: what happens to it.

Each row has a reference, such as A7, so it can be cited.

1.3 Words used here

Words that have one meaning in every one of our documents, such as member, visitor, staff, the editor, record item, hold, case and tip, are defined in Definitions. The words below are added for this document's own subject, or repeated from Definitions for convenience. If a repeated meaning ever differs, Definitions governs the meaning of the word.

Deleted means removed from the live database.
Blanked means the personal fields are emptied and the row stays, so that other records which point to it still make sense.
A tombstone is the nameless marker left where a public page used to be, so that an old link says "no longer listed" and does not simply fail.
Reduced to a count means only a total is kept, with nothing that identifies anyone.
A keyed hash is a one-way scramble made with a secret key that only our servers hold. It is still personal information and is listed here like any other.
A case is the file staff keep when something is reported, flagged, disputed or appealed.
The staff action log is our append-only record of what staff and automated rules did. It holds identifiers and reasons, never names or member text.
A legal hold is a written decision to keep specific records past their normal time because of a legal claim, an investigation or a legal duty (section 17).
Survives closure marks a record that is kept after the account it relates to is erased.

1.4 Periods are ceilings

Each period is the longest we keep the record in ordinary running. Many records can be deleted sooner by you, and section 2.1 says which.

2 Rules that apply to every row

2.1 You can often delete sooner

You can delete your own notes, a draft paper, a self-reported Record item, a house-question answer, a kept receipt, account copies of Workbench documents, and your interests and profile text at any time. Closing your account erases everything not marked "survives closure".

2.2 Clean-up runs in batches

Deletion is done by scheduled clean-up that runs at least once a day and does a limited amount of work each time, so the site stays within its daily limits. A record whose time is up is removed on a following run, usually in a day or two, and later if that day's limits are reached. Where a row gives a period in hours or minutes, the record stops being shown at that time even if the row itself is cleared a little later.

2.3 Open cases

A record that is evidence in an open case is kept with the case until the case closes, whatever its own row says. It then follows the row for that kind of case in section 10.

2.4 Copies made for a case follow the case

When something is reported, the system copies the reported item and its surroundings into the case. The original still follows its own row. The copy follows the case's row. That is why a line of table chat disappears from the room's log after 14 days while a reported exchange remains in its case file for longer.

2.5 Legal holds and legal duties

A legal hold, a lawful preservation request, or a law that requires us to keep something overrides the period for the records it covers, and for no others (section 17).

2.6 Backups

Every period here describes the live database. Backups keep older copies for a limited time (section 15).

2.7 Counts without names

Totals that identify nobody, such as how many pots were brewed on an evening or how many emails were sent on a day, are not personal information. We keep them without a time limit to understand how the site is used and what it costs.

2.8 Months and days

A period in months runs from the starting event to the same date that many calendar months later. "Days" are calendar days.

3 Accounts, sign-in and settings

Accounts, sign-in and settings. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
A1	Account record: your name, college email address, school, the date you joined, the date of your last email check, the time the 18+ check was done, the account's status, the last day you used the site, and your founding number if you have one. The last day is never shown to other members; it is used to decide whether to send the weekly letter and when unused Workbench copies lapse	You close the account, staff erase it, or a removed account reaches row A19	While the account is open, then the closing period in row A20	Name, email address and school are blanked. A blank row with an internal identifier stays so that other records still make sense
A2	Date of birth	Not applicable	Not stored. It is evaluated at sign-up and discarded in the same step	Nothing to delete
A3	Your answer to the status question at sign-up (undergraduate, graduate or recent graduate)	Sign-up	While the account is open	Deleted with the account
A4	A declined age check: a cookie in that browser, and a keyed hash of the email address used	The sign-up is declined	Up to 30 days	The cookie expires and the hash is deleted. No birth date is kept at any point
A5	A sign-up that was started and never finished: the email address entered and the code sent	The code is sent	Until the code expires, and no more than 24 hours	Deleted. No account exists
A6	One-time codes, kept in scrambled form	The code is issued	Valid for about 10 minutes. Cleared no more than 24 hours after being used or expiring	Deleted
A7	Sessions: a scrambled session token, when it was created and last used, how you signed in, a device label, and a keyed hash of the IP address the session was opened from	Sign-in	Until you sign out or sign the device out. Otherwise 60 days without use or 180 days in all, whichever comes first	Deleted
A8	Passkeys: the public key, its identifier, a label, the kind of device, whether the passkey is synced, a use counter and when it was last used	You add the passkey	Until you remove it or the account is erased	Deleted
A9	Account events: a new device, a passkey added or removed, a name or address change, the yearly email check	The event	While the account is open	Deleted with the account
A10	Consent records: each agreement or permission, the version of the wording you saw, when you agreed and when you withdrew	You agree or withdraw	While the account is open, then 24 months after it is erased. Each agreement to a document is also written to the staff action log (row H19) as an identifier, the documents and versions, a fingerprint of the wording and the time, and that entry is kept for as long as Tillyard operates	Deleted. Survives closure. The log entry stays
A11	Settings: time zone, notification choices, display settings, who may nod to you, and which notices of a small correction to a document you put away	You set them	Until you change or clear them, or the account is erased	Overwritten or deleted
A12	Interests	You pick them	Until you change them or the account is erased	Deleted
A13	Public-profile text and your per-field visibility choices	You write them	Until you change them or the account is erased	Deleted
A14	Former names: the old and new name in the record of a name change	The change is applied, declined or cancelled	12 months	Both names are blanked in the change record. The row is deleted with the account
A15	A request to change your school email address	The change is applied, cancelled or lapses	30 days	Deleted
A16	The weekly-letter schedule	You switch the letter on	While it is on	Deleted when you stop it
A17	Data export log: that an export was started, when, and how many parts it had. The export itself is put together in your browser and is never stored on our servers	You start an export	The export stays open for 30 minutes. The log row is kept 90 days	Deleted
A18	Connections, mutes and the blocks you placed	Created	Until you remove them or the account is erased. Nods are in row C5	Deleted
A19	An account removed by staff	The removal decision	12 months, unless the member closes the account sooner	Erased as in row A1, with no closing period
A20	The closing period	You confirm that you want to close	14 days. Longer only while the closure is on hold (section 17)	The erasure run starts and usually finishes in a day or less
A21	Departure record: identifiers and dates showing that erasure ran	Erasure finishes	24 months	Deleted. Survives closure
A22	A keyed hash of the email address of an erased account	Erasure finishes	90 days if the account was in good standing. 24 months if other members had blocked it or a report about it was open. 36 months if staff had removed it	Deleted. Survives closure
A23	Blocks that other members placed on you	They block you	Until they unblock you or their own account is erased. Remembered against row A22 after you leave	Deleted
A24	Notices in the app	The notice is created	90 days	Deleted
A25	How you arranged your home page, and cards you put away	You arrange it	Until you change it. A put-away card comes back after 90 days	Deleted with the account
A26	The link between a new member and the code on the join link or printed sheet they came through. The code names a place or a kind of page, never a person	You join	Up to 30 days	Deleted. Only daily totals for the code remain (row E12). Invitation links to a scheduled table are in row E7
A27	The titles ledger (our software calls it the credentials ledger) and the perks ledger, including a founding number	An entry is made	While the account is open	Titles are retired and perks deleted when the account is erased. A founding number is retired and is not given to anyone else. The staff action log keeps the identifiers
A30	The editor's signed statement behind a title: what was signed, for whom and on what basis	The title is signed	While the title stands, then 3 years after it is withdrawn or retired. If the account is erased, the editor's sentence is blanked at once and a row with no name remains as a count	Deleted at the end of the 3 years. Blanked at erasure
A28	Interest you registered in something that is not open yet, such as the research cohort, with your answers	You register	Until you withdraw it or the account is erased, and no more than 24 months untouched	Deleted
A29	Accounts that go quiet	Not applicable	No automatic deletion at present. Rows D1 and G3 still apply	See the Privacy Notice, section 16.6

4 The Shop

The Shop. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
B1	Table chat	The line is sent	14 days	The whole log for that day is dropped. Lines already copied into a case follow the case
B2	Outside call-link events at a table	The link is set or cleared	14 days, with that day's chat	Dropped with it
B3	Presence: that you are in a room, and at which table	You enter the room	Until you leave and the room has handed over your visit summary, a matter of minutes	Deleted
B4	Visit record: when you arrived and left, your drink, your one-line status, pots finished and how long you studied	The visit ends	30 days, unless you keep the receipt	Deleted. A kept receipt stays until you delete it or the account is erased. The length of the visit has already been added to your running total (row B16)
B5	Coffee ring	You leave the table	24 hours	The ring stops being shown and its fields are cleared
B6	Stamp counts, postmarks and the mug	They are earned	Until the account is erased	Deleted
B7	Who shared your table, trade-card ticks and Fifteens	That evening	30 days	Deleted. A connection made by trading cards stays as a connection (row A18)
B8	Thanks given and received	The thanks is given	180 days	Deleted
B9	House-question answers	You post the answer	120 days, or until you rub it out	Deleted
B10	Favors	The offer is posted	An open offer lapses after 14 days. An accepted favor that is never finished lapses after 21 days. A finished favor is kept 12 months	Deleted. If you leave first, a finished favor stays in the other person's history without your identity
B11	"Coming tonight" (RSVP)	That evening	7 days after it	Deleted
B12	The Morning Edition	It is published	30 days	Deleted. Your name is removed sooner if your account is erased
B13	Your Shop preferences and opt-ins	You set them	Until you change them or the account is erased	Deleted
B14	Evening totals: orders, people, campuses and pots, with no names	Not applicable	No limit	Not personal information
B15	A study room a member opened: its name, what it is for, its topics, who may come in and its hours	The room is opened	Until the member closes it or erases the account. A room nobody visits for 14 days closes by itself	Closed and no longer listed. The row is deleted when the member erases the account
B16	Your running study-time total: one number, added to when a visit ends	A visit ends	Until the account is erased	Deleted
B17	The house total of study time: everyone's added together, with no names	Not applicable	No limit	Not personal information. It stays when a member leaves

5 Messages and threads (private messages)

Messages and threads (private messages). Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
C1	Private notes and messages in group threads: sender, text and time	The message is sent	Up to 12 months. Sooner if you take the message back or your account is erased	Deleted. When you take a message back, or when your account is erased, its text is removed at once for everyone in the conversation, and the conversation shows only that a note was there. A copy taken into a case follows the case
C2	A kept copy of a note you edited or took back	The edit or the taking back	14 days	Deleted. It is kept that long only in case the note is reported
C3	A note waiting to be delivered, or held by screening and never delivered	The note is sent	Until it is delivered. A held or refused note, 14 days after it is decided or lapses	Deleted. A copy taken into the case it opened follows the case
C4	Conversations and threads: who is in them, thread names, read marks, your mute and pin choices, and invitations	Created	Until nobody is left in the conversation. A closed thread, 30 days	Deleted. When you leave or your account is erased, your seat shows only that a member left
C5	Nods and introductions: who nodded to whom or introduced whom, when, and where they met	Sent	An unanswered nod lapses (currently after 14 days). The record is kept 180 days after it lapses or is answered	Deleted. A connection that came of it stays as a connection (row A18)
C6	Reactions to a note	You react	With the note	Deleted with it
C7	Your private memos about a connection, follow-up dates, your away line and your Notes settings	You write or set them	Until you change them, the connection ends or the account is erased	Deleted
C8	Calls between connections: who called whom from which conversation, who was rung, who answered, and when each person joined and left the call. Never any sound: calls are not recorded	The call starts	Up to 12 months, as for notes. Sooner when your account is erased	Deleted. When your account is erased, your part in each call is deleted at once. A copy taken into a case follows the case

6 Tillyard Research

Tillyard Research. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
D1	A draft that has not been submitted	The last edit	12 months untouched. A warning is sent at about 11 months	Deleted, with its versions and sources
D2	Draft history: saved versions, counts of typing and pasting, and the record of each paste (when, how long, and the pasted words up to 2,000 characters)	The final decision on the paper	Thinned to 8 versions at the decision, then deleted 90 days later. For a draft never submitted, kept with the draft	Deleted. The published version is kept while the paper is published
D3	A submission that was declined, or withdrawn before publication	The decision or withdrawal	24 months	Deleted
D4	Sources, the frozen sections, fingerprints and the checks report, and the figures of a submission	Submission	With the submission	Deleted with it
D5	A co-author invitation that was refused	The refusal	30 days	Deleted
D6	Byline and licence record: your name and college as printed, the licence version and when you accepted it	Publication	While the paper is published	The byline is removed when the paper becomes a tombstone. Your acceptance of the licence is kept as a consent record (row A10)
D7	An offer to read that was declined or lapsed	The decline or lapse	30 days	Deleted
D8	Readings: scores, reasons and source checks	The decision on the paper	24 months	Deleted. If the reader's account is erased first, the reader's identity is blanked at once and the reading stays until this date
D9	Decisions, the editor's questions and your answers, and appeals	The decision	24 months, or while the paper is published if that is longer	Deleted
D10	Published papers, correction and withdrawal notices, and Readers' Selection lists	Publication	Until the paper is withdrawn	The page becomes a tombstone showing the title, the volume and number and the notice, with no byline and no text. Tombstones are kept so that links keep working
D11	Reading-pool membership, your fields and your practice read	You join the pool	Until you leave the pool or the account is erased	Deleted
D12	DOI look-up cache: public reference details, nothing about who asked	The look-up	6 months	Deleted
D13	A research proposal: the question, method, timeline, budget, where you will publish, and the team you list	Created	A draft, 12 months after the last change. A declined proposal, 12 months after the decision. A proposal that received a grant, seven years after the grant ends	Deleted. A proposal that received a grant is not erased when you delete your account, because it is a financial record
D14	A request to join a research team, what was written to the lead, and whether the person agreed to be named	The request	12 months after it is declined or the person leaves the team, or until the project is deleted or the account is erased	Deleted
D15	Reviewers' scores and comments on a proposal, a declared conflict of interest or a recusal (a person stepping aside from reading or deciding it), the decision and the reasons written for the applicant	The decision	As long as the proposal they are about	Deleted with it
D16	A research grant: the amount, whether the name may be shown, the results link; and the signed grant agreement: the typed name, the drawn signature, the time, the account and a fingerprint of the exact text	The agreement is signed	Seven years after the grant ends	Deleted. Not erased when you delete your account, because it is a financial record and the signed agreement
D17	Grant spending and its receipts: the amount, the date, what it was for, and the photo or PDF if one was attached	The expense is entered	Seven years after the grant ends, with the receipts	Deleted, receipts first. Not erased when you delete your account
D18	Grant reports: progress and final	Sent	Seven years after the grant ends	Deleted
D19	Payments marked as sent for a grant	Marked	Seven years after the grant ends	Deleted. Not erased when you delete your account
D20	The list of people who may not apply for or receive a grant (trustees, officers, staff and their families), with an email address kept only as a coded fingerprint	The person is added	While the person is on the list, and 12 months after they are taken off	Deleted

7 Pursuits, scheduled tables, booths, organizations and service

The documents for each of these areas repeat the periods that apply to it: the official rules of a round, the Hosting Terms and Disclosure Policy, the Projects and Collaboration Terms, the Organizations Terms and the Service and Volunteering Terms. They are meant to match this section. If one ever differs, this schedule governs.

7.1 Pursuits

Pursuits. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E1	A round entry: text, link, declarations and standing	Results are published. For a draft never entered, the last change	Entered text, 24 months after results. A draft never entered, 180 days without changes, after a notice	Entered text is blanked and the counts are kept. A draft is deleted
E2	Scores and reasons in a round, and the name you put down for a round	Results are published	Scores and reasons, 24 months after results. A scoring row that lapsed or was stepped aside from, 30 days. Names put down are deleted at results	Deleted
E3	A portfolio piece: text, link, declarations and sealed figures	The last change	While its Record item is active. Otherwise 24 months after the last change. A draft, 180 days	Deleted
E4	Looks: what a reader typed after opening a piece or its link	The look is returned	While the piece is recorded, then 24 months. An offer that was declined or expired, 30 days	Deleted. If the reader's account is erased first, the reader's identity is removed and what they typed stays until this date
E5	Your own dated logs	You write an entry	Until you delete it or the account is erased	Deleted
E33	Pursuits you keep on your page	You keep one	Until you take it off or the account is erased	Deleted

7.2 Scheduled tables and hosting

Scheduled tables and hosting. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E6	A scheduled table or series: title, note, host and times	The table takes place, or is called off	A table that was called off or did not meet, 90 days. A table that met stays as a count for the people who sat at it	Deleted. If the host's account is erased, the title and note are blanked and the table stays as a count for the people who sat at it
E7	Seats, standby places, invitation links and questions for a table	The table takes place	90 days	Deleted
E8	Attendance and the answers to the three feedback questions	The table takes place	400 days	Deleted. Only term counts and totals remain
E9	A host's term counts	The term	While the host has an account	Deleted with the account
E10	A title request, with the brief the editor saw and the decision	The decision	2 years	Deleted. Only counts remain in the staff action log
E11	Notices you asked for about a host or a table	You ask	Until you withdraw them. A one-time ask, 30 days	Deleted
E12	Printed sheets and their codes: who made a code, the place it names and its dates. Daily scan totals hold nothing about who scanned	The code ends	400 days after the code ends. Daily totals, 24 months	Deleted
E13	The log of looks at public posts under the disclosure rule: member, outcome and month, with no post text and no addresses	The look	3 years	Deleted

7.3 Projects and booths

Projects and booths. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E14	A project: name, aim, kind, field, write-up, links, milestones, declarations and counts	The project is closed or put away	While anyone holds a Record item that rests on it. Otherwise 12 months after it is closed or put away	Deleted
E15	Seats: the team agreement version each person accepted and when, plans, claims, results and choices	Created	With the project. An invitation or request that ended, 30 days	Deleted. Acceptance of the team agreement is also a consent record (row A10)
E16	The ledger: the day of each session, who sat, the pots, done lines and notes. How long each person sat is not kept	The session	With the project. A cancelled or empty session, 90 days. A line or note you delete goes at once	Deleted
E17	Help Wanted cards, and answers to them	The card comes down, or the answer ends	A card, 90 days after it comes down. An answer, 30 days after it ends	Deleted
E18	Your answers in "Who did what" (the blind confirmation)	The project is recorded	With the project (row E14)	Deleted. If your account is erased first, your identity is removed and the answers stay with the project
E19	Credit questions, and any note written for staff	The question closes	24 months	Deleted
E20	Words between collaborators	Written	Until removed or withdrawn, or with the project	Deleted

7.4 Student organizations

Student organizations. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E21	An entry: name, kind, description, directory address, and who registered and confirmed it	Registered	While the entry exists. A closed entry's text, 24 months, or while a Record item refers to it. A registration nobody confirms, 21 days	Deleted
E22	The roster and the roll: who is on it, and a count and month of attendance	You join	Until you leave, are taken off, or the entry closes. A request to join, 14 days	Deleted
E23	Officer roles, their dates and who confirmed them	The role is claimed	While the holder has an account. A claim nobody confirms is removed after 21 days	Deleted. A confirmation given by someone whose account is later erased stays as a count without their name
E24	The meeting ledger: counts only	The meeting	24 months	Deleted
E25	Notices and handover sheets	Written	A notice, 30 days after it expires. Sheets, the newest four	Deleted
E26	Disputes about an entry or a role, and decisions on them	The decision	24 months	Deleted

7.5 Service

Service. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E27	Service entries and co-participants' parts: description, dates, link and the statements ticked	Created	A confirmed entry, until you remove it or the account is erased. A draft, or an entry sent back or lapsed, 180 days untouched, after a notice	Deleted, with the confirmations, parts and readings attached to it
E28	The outside confirmation behind an entry	The confirmation	See rows K2 to K5	See those rows
E29	Your usernames on outside sites, and the codes that show an outside account is yours	You add them	Until you remove them or the account is erased	Deleted
E30	The readers' pool for links: your membership, and what you typed when you read one	You join, or return a reading	Membership, until you leave the pool. Your sentence, 24 months. The values that were compared, for the life of the item they support	Deleted. If your account is erased first, your name is removed and the compared values stay
E31	Help-table tallies: counts, and scrambled markers of the members who were helped	The term	Counts, for the life of the item. Markers, 12 months after the term	Deleted
E32	The shared list of organizations, and the link to who added each one	Added	The organization stays on the list. A row nobody used, 30 days	The link to the member who added it is removed if that account is erased

7.6 Learning teams

Learning teams. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E34	An application to join a learning team for a term: why you want to take part, what you built, your state, your team choices	You apply	A declined application, 90 days after the decision. Any other, 12 months after the term ends	Deleted
E35	Your place on a team: the team, what you want to learn, your duties and the ticks against them	You are accepted	12 months after the term ends, then the plan text is cleared	Plan text cleared; the dates stay as a count
E36	Weekly notes you write for your lead and the program director	You write the note	12 months after the term ends, or until the account is erased	Deleted
E37	Hours you write down yourself, for a school that may give credit. Nobody checks them	You add a line	12 months after the term ends, or until the account is erased	Deleted
E38	The signed agreement and learning plan: the name typed, the time, the account, and a fingerprint of the exact text	Each signature	For as long as the agreement could matter	The typed name is erased if the account is erased; the fingerprint and times stay
E39	A volunteer team lead's invitation and answer	The director asks	12 months after the term ends	Deleted
E43	A member's request to be emailed once when applications open for a term on a team	The member asks	12 months, or once we have written to them, or when they take themselves off the list	Deleted

7.7 College pages, founding numbers and invitations

College pages, founding numbers and invitations. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E40	A founding number: the number, the college, which first act earned it, and when	The act is counted	While the account lives	The name is removed and the number stays, so a number is never given twice
E41	An invitation you made to one table: its code, the table it points at, and whether it shows your name. Nothing is kept about who opens it	You make it	Until you end it or the table has met, and no more than 90 days after	Deleted
E42	A college page: a count of members, and the rules of the founding window as they were when it opened. Totals only	The college has members	While the college has members	Deleted

7.8 Sponsored projects

Sponsored projects. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
E44	A team on a sponsored project: its name, its short note and who leads it	Created	A team whose findings were never published, 12 months after the project ends. A team with published findings stays with its findings	Deleted
E45	Your place on a team: that you are on it, whether you lead it, whether you chose to be named, and when you agreed to the official rules	You join	Until you leave, the team is deleted, or you delete your account	Deleted. Your name stays off public pages unless you ticked the box to be credited
E46	A request to join a team, the line you wrote to the lead, and an invitation to you	Sent	12 months after it is answered or taken back, or until the team is deleted or the account is erased	Deleted
E47	Findings sent for a sponsored project, and the team lead's agreement to license them under CC BY 4.0	Sent	Published findings stay on the project page under the licence. A draft or withdrawn finding, 12 months after the project ends	Deleted. When you delete your account your name comes off the credit and the findings stay
E48	Your choice to put the home page banner for a project away, for now or for good	You choose	30 days after the project ends, or until you delete your account	Deleted
E49	A sponsor's contact: a name, an email address that is stored sealed, and the line winners are told for arranging a prize	The project is made	12 months after the project ends	Cleared. A project's own record (the question, criteria, prizes, winners and the reasons) is the organization's record and holds no student's name

8 The Record

The Record. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
F1	Record items approved by the editor or staff, and items recorded by the system, members or an outside party	The item is created	The life of the item	If the item is withdrawn, its page reads "withdrawn". If the account is erased, the page becomes a tombstone (row F3)
F2	Self-reported items	You add the item	Until you remove it or the account is erased	Deleted
F3	Tombstones for record pages: the page address, its code, its last status and the month, with no name, title, school or reason	The account is erased	36 months	Deleted. The address then answers "nothing is listed here". Survives closure
F4	Your public page and its settings	You switch it on	Until you switch it off or the account is erased	Deleted
F5	Your directory entry: name tokens and school	You are listed	Only while you are listed	Deleted at once when you opt out, when the page is held, or when the account is erased
F6	Directory searches	Not applicable	Not logged	Nothing to delete
F7	A signed-out visitor's search pass	The pass is issued	10 minutes	Lapses
F8	Open counts: daily totals for each item, with nothing about who opened it	The day	400 days	Deleted
F9	The "name updated" note shown on your pages after a name change	The change	12 months	Removed
F10	Skills linked to an item	You link them	The life of the item	Deleted with it
F11	A link or code typed into the "check a record" box	Not applicable	Not stored or logged	Nothing to delete

9 The Workbench and The Almanac

The Workbench and The Almanac. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
G1	Documents, snapshots and practice results kept in your browser	Not applicable	On your device. We do not hold them	You clear them, or your browser does
G2	A résumé file you import	Not applicable	Not stored anywhere. It is read in your browser and released	Nothing to delete
G3	Account copies of your documents, your tracker, or both	You switch copies on	Until you delete them, switch copies off or close the account, or after 24 months without a sign-in	Deleted. A deletion marker is kept 30 days so your other devices learn of it, then removed
G4	The anonymised copy of your résumé in the swap	Your swap entry closes	30 days	Blanked
G5	Notes written in a swap	The notes are delivered, or the swap ends without delivery	12 months if delivered. 30 days if never delivered	Deleted. If the writer's account is erased first, the writer's identity is blanked and the notes stay until this date
G6	Swap pairing history, used to avoid pairing the same two people again	The swap ends	12 months	Deleted
G7	A bar from the swap set by staff after a report	The decision	Until staff lift it	Deleted. The case behind it follows section 10
G8	The Almanac: guides and entries you saved, read or put away, reminders you asked for, a signal that a link did not open, your chosen fields and your notice switch	You save, mark or set it	Until you remove them or the account is erased. Marks on an entry we have retired, 30 days after it is retired	Deleted
G9	The details you type into a letter or email template in The Almanac: your name, school, year and field	Not applicable	On your device only. They are never sent to us	"Forget these", signing out and closing your account clear them

10 Safety, cases and legal records

Safety, cases and legal records. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
H1	Reports: who reported, the category and what they wrote	The report	With the case	Follows rows H3 and H4
H2	A hold on an item	The hold	Until it is released or the case is decided	The item is shown again or removed. The record of the hold stays in the case
H3	A case closed with no action	The case closes	12 months	Deleted. Survives closure
H4	A case in which action was taken	The case closes, or any appeal ends	24 months where the outcome was a notice, a mute, a suspension or a withdrawn item. 36 months where an account was removed	Deleted. Survives closure
H5	Strikes	The decision	A strike counts for 12 months. Its record stays in the case	It stops counting, and is deleted with the case
H6	Evidence packets: the reported item and its surroundings, times, the room or thread, account ages, earlier report counts, screening results, and a keyed hash of the IP address with the browser type	The report	With the case. The hashed IP address and browser type are removed after 90 days	Deleted with the case
H7	Appeals and their outcomes	The appeal	With the case	Deleted with the case
H8	The screening verdict and reasons	The screening	With the item screened or the case it opened, for as long as that is kept. No separate store of scores is kept	Deleted with the item or the case
H8a	Text waiting to be re-checked because a safety service was unavailable: the text and the writer's identifier	The check could not be completed	Until it is checked, normally minutes, and never more than one day	Deleted when a verdict returns or the last attempt is made. Cleared at once if the writer's account is erased
H8b	The deny list: a one-way fingerprint of a link or text removed under an upheld removal request, used to find exact copies and to hold any later message that contains it	The request is upheld	With the removal request it came from (row H10), 5 years	Deleted with the request
H9	Safety signals that did not lead to a case	The signal	30 days	Deleted
H10	Intimate-image removal requests: the request record and the hidden copy of the removed text	The ticket closes	5 years, as the Intimate-Image Removal Policy also states	Deleted. Once the ticket is closed you can ask us to delete your contact details sooner
H11	Material we reported to the National Center for Missing and Exploited Children	The report is submitted	One year from the report, as federal law requires, and longer where the law requires it. See the Child Safety Policy	Deleted. Until then it is kept in a restricted place, with access limited to what the law requires
H12	Copyright notices, counter-notices and repeat-infringement records	The matter closes	3 years	Deleted
H13	Disputes and correction requests, including a withdrawn outside confirmation	The dispute closes	24 months	Deleted
H14	The refund and bank-dispute log: ticket, date, amount and outcome, never card details	The entry	7 years	Deleted
H15	An account closed because the member was under 18, and the record of an age re-check	The decision	The account is erased at once, with no closing period, unless a legal hold or a duty to preserve covers it. The record of the re-check and the case, with no birth date in either, 36 months	Deleted. Anything the law requires us to preserve follows row H11
H16	Legal requests we receive (subpoenas, warrants, court orders, preservation requests) and our replies	The matter closes	6 years	Deleted
H17	Records kept because of a lawful preservation request	The request arrives	For as long as the request lawfully requires, normally 90 days and a further 90 if renewed	The records go back to their normal rows
H18	The register of legal holds: what was held, why, who decided and when	The hold is released	6 years	Deleted
H19	The staff action log, including staff views of member data, uses of the view-as tool, decisions made by a standing rule, and an entry for each agreement to a document	The entry	For as long as Tillyard operates. It holds identifiers and reason keys, never names, email addresses or member text	Not deleted: the table refuses any change or removal, including by the owner. Survives closure. Once an account is erased, nothing in the live database connects its identifier in the log to a name or an address
H20	A keyed hash of the name and college of an account that staff removed	The removal	24 months	Deleted. It can only raise a flag for a person to look at, and a flag closes by itself after 30 days. Survives closure
H21	Staff notes about a member: facts written down so that one case can be read in the light of another	The note is written	24 months from the day the note was written, and never past the erasure of the account	Deleted. Staff notes are not in your export, because they may name other people; ask at legal@tillyard.org and the owner will send them with other people's details removed
H22	The log of requests about a person's own information (to see, correct or delete it): who asked, in a few words, and that it was handled	The request closes	3 years	Deleted. The correspondence itself follows row J4

11 Technical and security records

Technical and security records. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
I1	IP addresses in readable form	Each request	Not stored in our database. Our network provider processes them to deliver and protect the site	See row I5 for the provider's logs
I2	A keyed hash of your IP address in a rate counter	The request is counted	Until the counting window ends, which for most limits is an hour or a day. Never more than 30 days	Deleted
I3	A keyed hash of the IP address, and the browser type, attached to a report, a public-form submission or an evidence packet	Captured	90 days in a report or an evidence packet. 30 days on a public-form submission	Removed from the record. The rest of the record follows its own row
I3a	A keyed hash of the IP address a sign-in session was opened from, kept with the session (row A7). It is compared between accounts to notice when two appear to share a network before one is offered the other's work to read or score	Sign-in	Until the session ends: 60 days without use or 180 days in all, whichever comes first	Deleted with the session
I4	The master secret from which every key used for keyed hashes and sealed fields is derived	Not applicable	Kept for as long as the site runs. We replace it only after a suspected compromise	Hashes made before a replacement stop matching: IP hashes, the do-not-email list (row J3), the departed-account and returning-member hashes, and the sealed contact details on removal requests. The internal key-rotation procedure says how the do-not-email list is carried across
I5	Request logs kept by our hosting provider: time, address requested, response code, timing and network details	Each request	A few days, set by the provider's plan. Never more than 7	Deleted by the provider
I6	Rate and budget counters kept against a member or a session	The action is counted	Until the window ends. The longest window is 30 days	Deleted
I7	Bot-check results	The form is submitted	For that one request	Not stored
I8	Signed tickets and links: a room ticket, an unsubscribe link, a status link for a ticket	Issued	A room ticket, 20 seconds. Others, for the life of the thing they point to	They lapse. Tickets and links are checked by their signature and are not stored
I9	Daily totals for requests, database use and email, with no personal information	Not applicable	No limit	Not personal information
I10	Cookies and browser storage	See the Cookie and Storage Statement	See the Cookie and Storage Statement	See the Cookie and Storage Statement

12 Email and correspondence

Email and correspondence. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
J1	Daily counts of the email we send in each class (essential, notice, optional). Nothing about who received it, and no body	The email is sent	Kept as totals	Not personal information
J2	Delivery records kept by our email provider	The email is sent	As the provider's plan sets	Deleted by the provider
J3	An unsubscribe, or a "never email this address again" request. For someone who is not a member, kept as a keyed hash	The request	Until the person lifts it	Kept so that we can honour it. Deleted if lifted
J4	Email you send to our addresses: support, legal, security, accessibility, press	The last message in the conversation	24 months	Deleted from the company's mailbox. Longer if it is part of a case or a legal matter, which then follows that row
J5	Larger-support and sponsorship inquiries sent through the form	The inquiry is closed	12 months	Deleted
J6	Urgent alerts sent to the president's phone: counts of waiting items, due times, case and reference numbers, and check values from the staff action log. No names, email addresses or member text	The alert	As the alert service keeps them	Not personal information about members

13 People who are not members

People who are not members. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
K1	Visitors	Not applicable	No record names a visitor. See rows F8, I1 and I2	Not applicable
K2	An outside confirmer's name, role and email domain, as shown on a Record item	The confirmation	For the life of the item. If the confirmation link lapsed or the confirmer declined, 90 days	Removed when the confirmation is withdrawn, the item is removed or the member's account is erased. A tombstone carries no names. The confirmer's email address itself is not kept
K3	A keyed hash of the outside confirmer's email address, and a yes or no on whether the answer came from the same network as the member's	The confirmer answers	24 months after the answer	Deleted
K4	The one-time code sent to an outside confirmer	The code is issued	As row A6	Deleted
K5	A confirmation that was withdrawn or disputed by the confirmer	The withdrawal	As row H13	Deleted
K6	The name of a non-member in something a member wrote	Not applicable	With that item	Hidden at once on a qualifying request (see the Privacy Notice, section 3.13). Deleted with the item
K7	A waiting-list entry: your college email address and a keyed hash of it	You leave your address	Until we send the one email saying you can join. Never more than 12 months	Deleted. The hash stays only if you asked not to be written to again (row J3)
K8	A request to add a school to the list: the ending of its addresses, the college name as first typed and how many people asked. No email address and no IP address is kept in this row; the people who asked are in row K10	The request	The name is blanked when the request is decided. The row, 12 months	Deleted
K9	A request from a non-member about their own information, and a report made from a public page by a visitor	The request or report is closed	The correspondence and the report, 24 months. The log that the request was handled, 3 years (row H22)	Deleted
K11	An early-list entry: your email address, kept encrypted, a keyed hash of it, its domain and the date	You leave your address	Until we send the one email saying you can join or that donations are open. Never more than 12 months	The address is deleted. The hash stays only if you asked to be taken off, so it is not listed again
K10	The people who asked for a college to be added: email address, the college's name, the city and state they typed and a note if they wrote one. No IP address is kept with it	The request	Until the request is answered, and never more than 60 days. If the college is added, until the one email telling you has gone, 14 days at most	Deleted. A request that is turned down, or is for a college already on the list, is deleted at once

14 Tips, larger payments and business records

Tips, larger payments and business records. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
L1	A record of a tip on our own site	Not applicable	None exists. The site stores nothing about tips or tippers	Nothing to delete
L2	Payment records in the company's Stripe account: payer name, email address, amount, date and the limited payment details Stripe shows a business	The payment	Stripe keeps its records under its own rules. Copies we take for bookkeeping and tax are kept 7 years	Deleted from our files
L3	Written agreements for larger payments and sponsorships, and the invoices for them	The agreement ends	7 years	Deleted
L4	The refund and bank-dispute log	See row H14	See row H14	See row H14
L5	A sponsor account: the organization's name, the contact's email address and how it signs in, and which sponsored projects and grant rounds it is linked to	The account is closed	While the sponsorship lasts. The account stays as long as it has a gift on record (row L7)	Links deleted with the account. The account is switched off, or deleted if it never gave
L6	A sponsor's API keys: a keyed hash, the last four characters and a label	The key is revoked	Kept, revoked, while the account exists, so the log stays whole	Deleted with the account
L7	A gift started through a sponsor's page or the payments API: amount, fee covered, purpose, the name the giver typed, Stripe's checkout reference and whether it was paid. No card details	The gift	7 years	Deleted

15 Backups

Backups. Columns: ref, record, clock starts, kept for, at the end.
Ref	Record	Clock starts	Kept for	At the end
M1	The weekly copy of the database. Table chat is held in each room's own storage and is not in it	The copy is made, about once a week	No copy is kept longer than 12 weeks	Deleted by the owner as a weekly duty
M2	Rolling recovery copies kept by our hosting provider	Continuous	A period set by our plan with the provider, never more than 30 days	They roll off

A record you deleted, or that reached the end of its period, can persist inside a backup until that backup is deleted.
Nothing in a backup is shown to members, visitors or search engines, and staff do not look inside backups in ordinary running.
We do not restore single records from a backup to undo a deletion.
If the whole database ever has to be restored, we aim to re-apply the deletions, removals and holds made since that backup before the site reopens.

16 What outlives a closed account

Everything not listed here is erased when an account closes.

What outlives a closed account. Columns: what stays, why, how long, row.
What stays	Why	How long	Row
A blank account row with an internal identifier	So that other people's records, such as a conversation or a reading, still make sense	While those records exist	A1
The dated record of what you agreed to	To show what was agreed	24 months. The staff action log's entry for each agreement to a document stays as long as the log does	A10, H19
A departure record	To show that erasure ran	24 months	A21
A keyed hash of your email address	So that leaving and re-joining does not undo a block or a removal	90 days, 24 months or 36 months	A22
Your seat in a conversation, shown only as a member who left. The text of the notes you sent is removed	So the other person's conversation still reads properly	While the conversation exists	C1 and C4
A reading you wrote, without your identity	So the author keeps their feedback	24 months after the decision	D8
A paper with co-authors, with your byline replaced by "a former member"	Because it is also the other authors' work	While it is published	D10
A tombstone for a paper you wrote alone	So links keep working	See row D10	D10
Nameless tombstones for your record pages	So a link on an old résumé says "no longer listed"	36 months	F3
Swap notes you wrote for someone, without your identity	So the other person keeps their feedback	12 months	G5
A finished favor, without your identity	It is part of the other person's history	12 months	B10
Case files that involve you	Other members' safety, and our ability to answer a later complaint	12, 24 or 36 months	H3 and H4
A keyed hash of your name and college, if staff removed the account	To notice a removed person's return, for a person to look at	24 months	H20
Teammates' records that rest on something you confirmed: your blind answers, your confirmation of an officer's role, a score or a look you gave, without your identity	So that another member's record does not fall because you left	As rows E4, E18, E23 and E30 say	E4, E18, E23, E30
Your founding number, retired	So that it is not given to anyone else	Without limit, as a bare number	A27
The staff action log, which holds identifiers and reason keys and never names, email addresses or text	So decisions can be checked, and so that what was agreed can be shown	For as long as Tillyard operates	H19
The fact and date of any privacy request, removal request, copyright notice or dispute you sent us, with your contact details erased where the row says so	To show what was asked and what we did	As rows H10, H12, H13 and H22 say	H10, H12, H13, H22
The bare record of an age re-check, with no birth date	To show the check was done	36 months	H15
A refund or chargeback entry in the payments log	Tax and accounting	7 years	H14
A research grant and the proposal it came from, the signed grant agreement, its spending and receipts, and its payments	They are financial records, and the signed agreement	Seven years after the grant ends	D13, D16, D17, D19
A blanked row for a title the editor signed for you	Kept as a count	With no name and no sentence	A30
Anything under a legal hold or a legal duty to preserve	The law requires it	Until released	Section 17
Older copies in backups	Recovery from a failure	Up to 12 weeks	M1

17 Legal holds

17.1 What a hold is for

A hold keeps specific records past their normal time. We may place one when:

a report in an urgent category involving an account is open and that account asks to close;
we have received a subpoena, warrant, court order or lawful preservation request that covers the records;
a legal claim involving the records has been made or is reasonably expected;
a law requires the records to be preserved, as it does after a report to the National Center for Missing and Exploited Children.

17.2 How a hold works

Only the owner can place or release a legal hold. A hold on a closing account for an open case can be placed by the system and is reviewed by staff.
A hold names the records it covers and the reason. It covers those records and no others.
Held records are not deleted by clean-up. They are not shown anywhere they would not otherwise be shown, and a hold gives nobody new access to them.
A hold has no fixed length. Each open hold comes up for the owner to review at a set interval (currently every 90 days, and one year for a hold that follows a report to the National Center for Missing and Exploited Children). It is released when its reason ends, and the records then go back to their normal rows. If their time has already run out, they are deleted on the next clean-up.
Placing and releasing a hold are written to the staff action log, and the register in row H18 records each hold.

17.3 Telling the person concerned

If closing your account is on hold, the closing page says so, and you stay hidden in the meantime. We may be unable to say more where a court order or an investigation forbids it.

18 Records held by our providers

The companies that work for us keep some records of their own. We choose their settings to keep as little, for as short a time, as their service allows, but their retention is theirs.

Records held by our providers. Columns: provider's role, what it keeps, for how long.
Provider's role	What it keeps	For how long
Hosting and network	Request logs (row I5) and recovery copies (row M2)	Up to 7 days, and up to 30 days
Bot check	The signals described in the Cookie and Storage Statement	As Cloudflare's terms provide
Email delivery	Delivery records for email we send	As the provider's plan sets
Text-safety classification	Whatever the provider's terms allow it to keep of text sent for checking	As the provider's terms provide
Payments	The payer's details and payment records	As Stripe's terms and the law require of it
Reference look-up	The DOIs our server asks about, with nothing about who asked	As Crossref's terms provide
Urgent alerts	A case number and a severity level	As the alert service provides

19 Records on your own device

Cookies, your theme choice and everything the Workbench keeps in your browser are on your device, not on our servers. They last until they expire, you clear them or your browser clears them. The Cookie and Storage Statement lists each one and says how to clear it. Closing your account does not reach into your browser; the closing page offers a button to clear the Workbench's data there.

Anything you downloaded, printed or exported is yours to keep or destroy. So is any copy another person made of something you showed them.

20 How this schedule is kept accurate

Each part of the site declares the personal information it stores, with a purpose and a period, in a data inventory. A copy of that inventory is included in every member's data export, so the export explains itself.
A new feature that stores member text or personal information is not finished until it has an inventory entry and a deletion routine that the account-closing process calls.
We aim to review this schedule at least once a year, and whenever a feature is added or a provider changes.
If you find a record kept longer than this schedule says, tell us at legal@tillyard.org.

21 Changes to this document

The version number and effective date are at the top, and earlier versions stay available. Shortening a period, or adding a row for a new kind of record before that record is first collected, may take effect when published. If we propose to keep an existing kind of record for longer, we aim to tell members in the app and by email before the change takes effect, and the longer period applies only to records created after that date unless you agree otherwise.

This is version 1.3, in effect from October 21, 2026.

What changed in this version:

New rows K11 (the early list) and L5 to L7 (sponsor accounts, their API keys, and gifts through a sponsor's page or the payments API).

22 Contact

Questions about this schedule, or a request to delete something: legal@tillyard.org
Help using the deletion and export tools in your account: support@tillyard.org
Post: Tillyard, Privacy, 10602 York Rd SW, Etna, Ohio 43062

Questions about this document: support@tillyard.org
Legal notices: legal@tillyard.org
By post: 10602 York Rd SW, Etna, Ohio 43062

For anything else, see where to send what.

Fingerprint of this text (SHA-256): 035779aedf926bd7e93ef00d47c16ab07562bd43d464f3701ab31bd345f73997