Data Retention Schedule

| data | retention |
| --- | --- |
| Account auth metadata | until account deletion |
| Encrypted messages | 90 days unless pinned |
| Encrypted media | 90 days unless pinned |
| Call metadata | 365 days |
| Push tokens | until revoked |
| Reports | 365 days |
| Failed-login throttle | 24 hours |
| Audit logs | 7 years |
| Breach incidents/records | 7 years |

These are defaults — see /admin/retention-policies for the live values.