Retention and privacy
Current contract windows
Section titled “Current contract windows”| Data | Retention contract |
|---|---|
| Event Log | 90 days |
| OAuth authorization code | Functionally valid for 60 seconds; consumed or expired digest rows purge within 24 hours |
| MCP action audit rows | At least 90 days, then daily purge |
| Soft-deleted Tasks | 30 days, then daily hard purge |
| Attachments on completed Tasks | Contracted for purge 30 days after completion; availability depends on the implemented storage lifecycle |
Webhook endpoint, filter, secret, gap, replay, and delivery-history retention is published only with the generated webhook contract. The public reference does not infer those values.
Sensitive data boundaries
Section titled “Sensitive data boundaries”Free personal data that remains local to a device is not available to hosted integrations. Cloud-backed data is still filtered by connection, audience, scope, ownership or membership, and entitlement.
Event snapshots omit sensitive bodies and operational storage detail. OAuth authorization codes are stored as digests, not reusable credentials. The generated webhook examples document exact signed bytes and the 24-hour current/previous-secret overlap without exposing production secrets.
Account deletion
Section titled “Account deletion”Account deletion removes the person’s server-side account data according to the published policy and service deletion workflow. Device-local data is controlled on the device. Review the current Privacy Policy and Account Deletion guide before deciding how your integration should handle a disconnected or deleted account.