Retention policy
SaySi · Last updated 2026-11-14
Never kept
Original photos (before cropping): never stored, on the phone or the server. Our server holds page photos only in memory while the request is processed.
Cropped page photos stay only in that phone's archive, until you delete them there or delete the app. They are never kept on our server.
24 hours
A family's page text (the reading and its translations) and audio files: a 24-hour working copy on the server, then deleted. The copy on the phone stays until you delete the book or the app. The sentence of a word saved to the word notebook is kept as described under "Word notebook" below.
Until the book or account is deleted (or 18 months without use)
Page fingerprints, the page list, pearl records, child profiles, daily reading time.
Word notebook
Saved words, their meanings, their sentences (both languages) and the book and page they came from: until you delete the word or the account. A word's sound file (one per word, nothing about the family) is shared by everyone and is kept.
While the account exists
Guardian consent records (the proof of consent).
30 days
Error reports (when you tap "Send to developer" on an error screen: the screen address, app version, platform and app language, and the error text with email addresses and tokens removed): 30 days from receipt, or until the account is deleted if that comes first.
One year
Help & feedback messages (the text, attached pictures, the reply address, app version, platform and app language): one year from receipt, or until the account is deleted if that comes first.
Other
Service cost records (API calls, without family information): 13 months.
Server logs, including IP addresses: used only for security and to find faults, then deleted. Web server access logs are deleted within 15 days. The API server's logs are rotated by size (at most five 10 MB files per server, the oldest deleted first) and are deleted completely whenever an update replaces the server, so at quiet times they can be older than 15 days, but never more than the latest 50 MB.
Account deletion completes within 30 days and backups age out within 35 days. A pearl total that cannot identify the family remains for tax records. Store transaction and pass records are retained without a family link to prevent duplicate grants. So that one email address or sign-in account cannot receive the signup gift twice, and one device cannot receive a referral reward twice, hashed values of them (no family information) remain. Referral records lose the reference to this family.