Retention Policy
Last updated: 2026-09-02
This document sets out how long FoodTrack retains uploaded files and the records generated by processing them. It's referenced from our Privacy Policy rather than duplicated there.
General principle: uploaded files and the records generated from them are processed for a specific purpose — moderation, OCR of nutrition labels, abuse investigation — and are not retained for longer than that purpose, plus any legal retention obligation, requires. Nutrition-label photos are the one deliberate exception: they're retained indefinitely by design, not just for the moment of OCR extraction, because they double as ongoing reference content for the shared product database (a live-bucket object doesn't expire on its own — see the table below). Progress photos and workout route data don't have this exception; they're kept only for as long as the underlying record (the measurement, the workout) exists, i.e. until deleted by the user or as part of account deletion.
Uploaded files
| Stage | Versioning | Retention |
|---|---|---|
| Quarantine bucket (awaiting scan) | Off | 48 hours |
| Live bucket (in normal use) | On | Current version: indefinite, for as long as the underlying record exists (nutrition-label photos: indefinitely by design — see above). Noncurrent (superseded) versions: 30 days |
| Flagged bucket (moderation hold, break-glass access only) | Off | 90 days |
Raw workout file originals (GPX/FIT/TCX)
Where a workout file upload isn't already a plain, uncompressed GPX file, we keep the raw original you uploaded — separately from the canonical GPX we derive and actually serve — for a fixed 30-day window, then it is automatically deleted. This allows us to reprocess your upload if we discover a bug in file conversion shortly after the fact, while bounding how long this raw personal location data is retained. This window is enforced automatically and is not extended on a case-by-case basis.
Reports
When a user reports content, we keep the report record (who reported it, what was reported, the stated reason, and when) for 1 year, after which it is automatically removed by a scheduled cleanup process. We keep it this long because reports are relevant evidence if a pattern of abuse (of the content itself, or of the reporting feature) emerges over time.
Scanning and moderation logs
Records of the outcome of automated malware scanning and content moderation are kept for approximately 1 year — longer than our general 90-day retention period for other personal-data audit records, since these logs are the evidence trail if a pattern of abuse needs investigating after the fact. This longer window is deliberately scoped to scan/match outcomes only; it does not extend to other, more sensitive data derived from your uploads (for example, GPS-derived route data extracted from a workout file, which is cleared once you've confirmed the upload and is not carried into these logs at all).
General account audit log
Changes to your account and tracking data (who made a change, what changed, and the IP address it was made from) are kept for 90 days, then automatically removed by a scheduled cleanup process. This is the default tier that applies unless a longer, specifically-scoped window is described elsewhere in this policy (the scanning/moderation-log tier above, or the reference-data tier that governs non-personal, shared records like the food item database itself).
Feedback
In-app feedback you submit is kept while it's still open ("new"). Once we've actioned it, we keep it for a further 30 days, then it's automatically deleted.
Data export archives
When you request a data export, the generated archive is kept for 30 days to give you time to download it, then automatically deleted regardless of whether you've downloaded it.
Review
These periods are reviewed as required — for example, when the underlying feature changes, or when a legal or regulatory obligation makes a period no longer appropriate — rather than on a fixed schedule.