Retention principles
DYNX24 keeps personal information only while it serves the account, shared-space, subscription, security, support, legal, or accounting purpose for which it is processed. We use event-based rules when a single fixed period would not match the product lifecycle.
- Minimize collection and avoid storing original financial import files.
- Keep active product data while the user or authorized family space needs it.
- Delete or de-identify information when its purpose ends, unless a legal, fraud-prevention, accounting, dispute, or security need requires limited retention.
- Restrict retained data from ordinary product use when it exists only for backup, security, or compliance purposes.
Retention schedule
| Data category | Normal retention rule | Deletion or end event |
|---|---|---|
| Account and profile | While the DYNX24 account is active. | Removed or de-identified after a verified account-deletion process, subject to narrow exceptions. |
| Financial-space records | While the space exists or until an authorized user deletes the record. | Deleted with an eligible owned space; leaving another person’s shared space only removes the departing member’s access. |
| Original statement and credit-report files | Not retained by the DYNX24 backend; parsing occurs locally on the device. | The user controls the original file on the device. Temporary in-app processing ends after the import session. |
| Saved import results | Selected transactions and normalized debt fields remain as product records. | Deleted when the user removes the record or when its eligible space/account is deleted. |
| Plaid connection credentials | Encrypted while the authorized read-only connection remains active. | Scheduled for removal when the connection is revoked or the eligible account/space is deleted; Plaid applies its own retention policy. |
| AI assistant processing | The bounded aggregate request is sent with store: false; DYNX24 content-free usage telemetry is retained only for operations, limits, security, and cost control. | Operational telemetry is deleted or aggregated after it is no longer needed; OpenAI applies its own API safety rules. |
| Subscription and billing metadata | While the subscription or trial is active and afterward as needed for accounting, tax, fraud, refunds, or disputes. | Deleted or de-identified when those obligations expire; payment providers retain their own records independently. |
| Invitations and role history | While pending or needed to operate and secure a family space. | Pending access is removed when accepted, revoked, or expired; limited audit metadata may remain where necessary. |
| Support and security records | Only while needed to resolve the request, protect the service, document consent, or meet legal obligations. | Deleted or de-identified when the operational or legal need ends. |
| Backups | For the limited rolling lifecycle configured with the infrastructure provider. | Expire through the backup rotation and are not restored to ordinary use after a valid deletion except for disaster recovery. |
- Data category
- Account and profile
- Normal retention rule
- While the DYNX24 account is active.
- Deletion or end event
- Removed or de-identified after a verified account-deletion process, subject to narrow exceptions.
- Data category
- Financial-space records
- Normal retention rule
- While the space exists or until an authorized user deletes the record.
- Deletion or end event
- Deleted with an eligible owned space; leaving another person’s shared space only removes the departing member’s access.
- Data category
- Original statement and credit-report files
- Normal retention rule
- Not retained by the DYNX24 backend; parsing occurs locally on the device.
- Deletion or end event
- The user controls the original file on the device. Temporary in-app processing ends after the import session.
- Data category
- Saved import results
- Normal retention rule
- Selected transactions and normalized debt fields remain as product records.
- Deletion or end event
- Deleted when the user removes the record or when its eligible space/account is deleted.
- Data category
- Plaid connection credentials
- Normal retention rule
- Encrypted while the authorized read-only connection remains active.
- Deletion or end event
- Scheduled for removal when the connection is revoked or the eligible account/space is deleted; Plaid applies its own retention policy.
- Data category
- AI assistant processing
- Normal retention rule
- The bounded aggregate request is sent with store: false; DYNX24 content-free usage telemetry is retained only for operations, limits, security, and cost control.
- Deletion or end event
- Operational telemetry is deleted or aggregated after it is no longer needed; OpenAI applies its own API safety rules.
- Data category
- Subscription and billing metadata
- Normal retention rule
- While the subscription or trial is active and afterward as needed for accounting, tax, fraud, refunds, or disputes.
- Deletion or end event
- Deleted or de-identified when those obligations expire; payment providers retain their own records independently.
- Data category
- Invitations and role history
- Normal retention rule
- While pending or needed to operate and secure a family space.
- Deletion or end event
- Pending access is removed when accepted, revoked, or expired; limited audit metadata may remain where necessary.
- Data category
- Support and security records
- Normal retention rule
- Only while needed to resolve the request, protect the service, document consent, or meet legal obligations.
- Deletion or end event
- Deleted or de-identified when the operational or legal need ends.
- Data category
- Backups
- Normal retention rule
- For the limited rolling lifecycle configured with the infrastructure provider.
- Deletion or end event
- Expire through the backup rotation and are not restored to ordinary use after a valid deletion except for disaster recovery.
Data that stays on your device
Original CSV, OFX, QFX, PDF, and supported text files selected for statement or credit-report import stay on the device and are not stored by the DYNX24 backend. Local-only app data is controlled separately from synchronized cloud data.
Deleting a cloud account may not erase files you kept elsewhere or local-only data remaining on a device. Use the device’s storage controls or remove the application data when you want to erase local copies.
Provider records
Supabase, Plaid, OpenAI, Stripe, Apple, and Google may keep records under their contracts, privacy notices, security programs, and legal obligations. A DYNX24 deletion request controls DYNX24-held data and the provider credentials we manage; it does not erase an independent purchase receipt or other record that a provider must retain.
Limited retention after a request
After a valid deletion or disconnection request, limited information may remain only when reasonably necessary to complete billing cancellation, prevent fraud, establish or defend legal claims, meet tax or accounting duties, enforce security, or comply with law. Such data is restricted to that purpose and removed or de-identified when the need ends.
Review and changes
Retention rules are reviewed when data flows, providers, legal requirements, or security needs change. The published policy will show a new effective date when updated. Shorter or longer periods required by applicable law take priority over the general rules above.
Questions and requests
Tell us which account, family space, connection, or record your question concerns. Do not send a password, bank credential, Social Security number, or credit-report file by email.
Questions about retention or a deletion request may be sent to contact@dynx24.com.