Last updated: DRAFT — not yet in force.
Our approach
Bricks and Octane keeps each category of data only as long as it is needed for the purpose it was collected, then deletes or de-identifies it. Some limits are enforced automatically by a scheduled pruning job; others are enforced when you close your account or ask us to delete your data. This policy sits alongside our Privacy Policy.
Retention by data type
| Data | What it is | How long we keep it |
|---|---|---|
| First-party analytics events | Hashed session id + coarse geo (no IP, no precise location) | Automatically deleted 90 days after the event by our pruning job. This window is configurable and enforced server-side. |
| Consent records | Your privacy choices, an age range, and a hashed cookie id | Kept while relevant so we can prove and honor your choices; superseded when you change them. |
| Account data | Username, email, hashed password, profile, and the age group you chose (plus a private birth month/year for members who joined before September 2026) | Kept while your account is active. Deleted after account closure or a verified deletion request (this is reviewed by a person because it cascades across your content). Final post-closure grace period is pending counsel. |
| Rejected age-gate attempts | A hashed device marker + a retry counter — no birth date, no email | We do not keep the personal details of a blocked under-13 sign-up. Only the anti-retry marker is retained to prevent immediate re-tries; final duration is pending counsel. |
| Submissions (builds, comments) | Content you submit, with attribution to the original source | Kept while published; removed on your request or when you close your account. Teen submissions are human-reviewed before appearing and never carry identifying details publicly. |
| Marketing contacts & leads | Email address and newsletter/nurture status, if you opted in | Kept until you unsubscribe or ask us to delete. A verified deletion request erases these automatically. |
| Email suppression list | Addresses that asked not to be contacted (including after deletion) | Kept indefinitely, deliberately, so we can honor an unsubscribe or deletion and never re-add the address. |
| Privacy (data-subject) requests | Request type, requester email, and status | Kept as a record that we received and actioned the request; final duration is pending counsel. |
| Payment records | Subscription status and entitlements (card data stays with Stripe) | Subscription state is kept while your membership is active and as needed for tax and accounting; card details are held by Stripe under its own retention terms. |
How deletion works
When you file a verified deletion request through the privacy request form, we erase your marketing contact records automatically and add your address to our suppression list so a later import cannot re-add you. Deleting a full member account is handled by a person because it removes your submissions and related content. Our automated pruning job separately deletes analytics events past the retention window regardless of any individual request.
Legal holds
We may keep specific data longer than stated above where the law requires it, or to establish, exercise, or defend a legal claim. The exact triggers are being finalized with counsel.
Contact
Questions about retention: privacy@bricksandoctane.com.