Data Retention Policy
This policy describes how long IBC Tool keeps your data, how we delete it when you ask, and where the limits of "deletion" are. We have written it to be specific. If you only have a minute, the short version is: we keep your data while your account is active, and we delete the account data in section 2 when you ask. We keep subscription payment records after that, for as long as tax, accounting, and payment-dispute rules require. We do not keep card numbers. Section 3 lists each category, including records that stay after deletion. Backup copies of deleted data age out on our hosting providers' schedule.
1. Active accounts
While your account is active, we retain everything needed to operate it — your account information, your policies, snapshots, loans and payments, PUA contributions, budget categories, allocations, uploaded documents, subscription payment records, and the third-party tokens you have authorized. We don't time-bomb data while you are using the service; a long history of snapshots is the value of the tool.
2. Account deletion
You can delete your account at any time from the settings page in the app. The flow asks you to type your email address, and then to enter a 6-digit code we email you, before proceeding. Once you confirm, IBC Tool removes:
- Your user record, including account information, encrypted third-party integration tokens, passkeys, and active sessions.
- Every policy on your account, along with its snapshots, loans, payments, PUA contributions, and uploaded documents.
- Your budget categories and monthly allocations.
- Provider identifiers we held for any third-party integrations you authorized.
- The entry with your email on our email list.
Subscription payment records are not in that list. We keep the plan, the amounts, the dates of charges and refunds, and the customer identifier from our payment processor. We keep them after you close the account, for as long as tax, accounting, and payment-dispute rules require. We never store your card number or your security code, so there is no card number or security code to delete.
The deletion of the items in the list above runs immediately. Database rows for those items are removed in the same request that handled the confirmation; uploaded documents are queued for purge from object storage as part of the same destroy. Backup snapshots roll forward as described in section 4 — copies in those snapshots age out on the hosting provider's standard window.
If you cannot reach the settings page — for example, if you have lost access to your account — email privacy@ibctool.app from your account address and we will run the same deletion on your behalf within thirty days.
3. Retention by data category
The table below describes what we keep while you are active and what happens when you delete your account. "After deletion" reflects the end-state once the in-app destroy described in section 2 has run.
| Category | While active | After deletion |
|---|---|---|
| Account info (email, name, timezone, the page and the site that sent you, the first page of that visit and the site that linked to it, the campaign tags of that first page, and the device class: phone, tablet, or computer) | Retained | Deleted from primary database; aged out of backups on the hosting backup window |
| Policies, snapshots, loans, payments, PUA contributions, budgets, allocations | Retained | Deleted from primary database; aged out of backups on the hosting backup window |
| Uploaded documents (PDFs) | Retained until you delete the document or close your account | Deleted from object storage; aged out of object-storage versioning if enabled |
| Third-party integration access and refresh tokens (encrypted in our database) | Retained while the integration is connected | Deleted on disconnect or account deletion, whichever is sooner |
| YNAB setup of each policy and each loan (identifiers of the plan, category, account, and scheduled transaction) | Retained while the sync is set up, also after a disconnect, so that reconnecting continues the sync | Deleted when you stop the sync for the policy or the loan, delete the policy or the loan, choose a different plan, or delete your account, and at the first sync after you pay off the loan |
| YNAB transaction of each one-time paid-up additions contribution (identifiers of the plan and the transaction) | Retained while the contribution exists | Deleted at the first sync after you delete the contribution, or when you delete your account |
| Sharing with your advisor's practice (the practice your account is linked to, your sharing choice, its requests to share, and the list of its views and changes) | Retained while your account is active, also after you stop sharing, so that you keep the record | Deleted with your account |
| Passkeys (public key, device name, date added, date last used) | Retained until you remove the passkey in Settings | Deleted when you remove it, or when you delete your account |
| Sign-in sessions and sign-in codes | A session stays until you sign out. A customer session does not expire on its own. A sign-in code expires in 10 minutes. We store only a hash of the code. | Sessions are deleted with the account. A sign-in code stops working after 10 minutes. The code row stays. It keeps the email address, the code hash, the purpose, and the request IP. |
| Application logs (request metadata, IP, error traces) | Per the hosting platform's default retention | Aged out on the same window |
| Error reports and masked screen replays of the app | Per the error-monitoring provider's retention window | Aged out on the same window |
| Email records (sign-in codes, service notices) | Headers and delivery metadata per the email provider's default retention, used for abuse prevention | Aged out on the same window |
| Subscription payment records (plan, amounts, charge and refund dates, processor customer identifier). Card numbers and security codes are not stored. | Retained | Kept after you close the account, for as long as tax, accounting, and payment-dispute rules require |
| Marketing site page counts (page path, referring site, campaign tags, device class: phone, tablet, or computer, whether the page is the first page of a visit, and time) | Kept. A count holds no account data. | Not tied to an account |
| Email list entries from the home page form or from signup. A form entry also has the page of the form, the first page of that visit and the site that linked to it, the campaign tags, the device class, and the IP address of the request | Retained until you ask us to remove you | Deleted with the account, or on request |
4. Backups
Our PostgreSQL database is backed up by our hosting provider on the provider's default schedule. Backup snapshots are encrypted at rest and are retained for the provider's standard window. When we delete your data from the live database, copies may persist in those backup snapshots until they age out. We do not selectively edit backup snapshots; we let them roll forward. If a restore from backup ever becomes necessary, we re-apply pending deletion requests after the restore completes so that data you asked us to delete is not silently revived.
Object storage for uploaded documents may use versioning depending on configuration. Where versioning is enabled, deleted versions age out on the storage provider's schedule.
5. Third-party connections
When you disconnect an integration or delete your account, we delete its access tokens at once. The YNAB sync setup and the plan name stay after a disconnect, so that reconnecting resumes the sync. The table above says when the setup is deleted. The plan name is deleted when you choose a different plan or delete your account. We do not store your posted YNAB transactions, balances, or the amounts you assign. Cached copies of YNAB lists are used for at most 15 minutes and removed within about two weeks, or when you delete your account.
What IBC Tool wrote to YNAB stays in YNAB, with two exceptions. When you stop a sync, delete a policy or a loan, choose a different plan, or delete your account while YNAB is connected, IBC Tool deletes the recurring scheduled transactions it created for your policies and loans. A scheduled transaction you already had and let IBC Tool manage stays, unless its loan is paid off. When you delete a one-time paid-up additions contribution before its transaction clears, the next sync removes or lowers that transaction, unless YNAB has already entered it on its date.
We do not control retention inside the third-party service itself. Each service maintains its own data lifecycle. To delete data within a connected service, follow that service's own process; we are happy to help you find the right path.
6. Anonymized aggregates
We may keep de-identified aggregate metrics — for example, the total number of accounts and other operational or product-quality statistics that cannot be linked back to you. These are used to operate and improve the service and do not contain personal data. We retain aggregates indefinitely.
7. Legal holds
If we are required by law to preserve specific records — for example, in response to a subpoena or a regulatory inquiry — we may retain those records beyond the windows in this policy until the obligation ends. If a legal hold affects you and we are permitted to tell you, we will.
8. Contact
Deletion requests, retention questions, or anything else covered here can go to privacy@ibctool.app.