This schedule forms part of the Caduo Privacy Policy. Caduo keeps personal information only for as long as it is reasonably required for the purposes described below, then deletes or de-identifies it unless a longer period is required or authorised by law.
| Information | Standard retention | Disposal or review |
|---|---|---|
| Active account, profile, preferences and profile media | While the account is active | Deleted from operational systems after a valid account-deletion request, subject to the exceptions below |
| Authentication record | While the account is active | Firebase Authentication record deleted with the account |
| Unresolved likes | Up to 12 months from creation | Automatically deleted |
| Active matches and messages | While the match remains active and both accounts remain active | Deleted when an account is deleted; an unmatched conversation is retained for up to 90 days |
| Unmatched conversation and date-plan records | Up to 90 days after unmatching | Match document and its subcollections automatically deleted |
| Private post-date feedback | While the account is active and ordinarily up to 24 months after submission | Deleted or de-identified after the review period; feedback linked to a safety matter follows the safety-record period |
| Blocks | While the blocking account remains active | Deleted with the account; may be replaced by a limited abuse-prevention record where necessary |
| Professional-verification identity image and live selfie | Up to 30 days after a decision | Files automatically deleted from locked storage; they may be preserved longer for an active appeal, fraud or safety investigation, legal hold or legal requirement |
| Verification application and outcome record | While current and up to 7 years after the final decision or account closure, where reasonably required | Reviewed and deleted or de-identified at the end of the period |
| Open safety report and associated evidence | Until the matter and any appeal are resolved | Then moved to the closed-report period |
| Closed safety, moderation, appeal and audit records | Up to 7 years after closure | Deleted or de-identified unless an active legal hold or continuing safety need applies |
| App Store purchase, entitlement, consumable-credit and transaction records | Up to 7 years from the transaction or as required by tax, accounting and consumer law | Active balances are removed with account deletion; limited transaction records are deleted or de-identified when no longer required |
| Push-notification tokens | While the device/account remains enabled | Replaced when refreshed and deleted with the account or when invalid |
| Optional analytics and performance data | According to the configured Firebase retention period, and no longer than 14 months for identifiable event-level analytics | Automatically deleted or aggregated; collection stops when optional analytics is disabled |
| Crash, security and diagnostic logs | Ordinarily up to 12 months | Automatically deleted or aggregated unless needed for an active security investigation |
| Support and privacy correspondence | Up to 3 years after the enquiry closes | Deleted unless linked to a longer-lived complaint, transaction or legal matter |
| Backups | Rolling encrypted backup cycle, ordinarily no more than 90 days | Expires through backup rotation and is not restored except for disaster recovery |
Account deletion
An in-app deletion request removes the authentication account, active profile, uploaded profile and verification media, likes, matches and messages, subscription entitlement mapping and other operational account records. Reported conversation evidence is copied into restricted safety cases before ordinary messages are removed. Open cases and held evidence are retained; closure starts the seven-year case retention period. Verification evidence under an explicit hold is preserved. Some information may be retained separately where reasonably necessary to comply with law, resolve a transaction, protect members, prevent repeat abuse, establish or defend legal claims, or honour a legal hold.
Retained records are access-restricted and are not used to return a deleted profile to discovery or for ordinary marketing. Where practical, direct identifiers are reduced or replaced with a one-way abuse-prevention reference.
Holds and exceptions
Deletion may be paused for information relevant to an active safety matter, appeal, chargeback, complaint, security incident, court order, regulatory request or reasonably anticipated legal claim. A hold applies only to information relevant to that purpose. When the hold ends, the normal retention rule resumes.
De-identification
Caduo may retain aggregated or irreversibly de-identified statistics that no longer identify or can reasonably be linked to a person. De-identified information is not used to reconstruct a deleted account.
Questions or deletion requests: admin@psychtrack.com.au
Off Shift additions — 6 September 2026
- Private availability: expires 14 days after saving. Expired windows are not returned to members while deletion is pending.
- Private date safety notes and check-in responses: expire 30 days after the check-in, subject to an applicable legal hold. They remain owner-accessible after unmatching until deletion.
- Shared date proposals: follow conversation retention. They do not contain private safety fields.
- Staged profile edits: remain owner-only while pending/rejected and are removed on publication or account deletion. Superseded media is removed by maintenance once no published or staged profile references it.
- Migration recovery files: restricted to deployment operators, retained locally for no more than 30 days and then securely removed. They are excluded from source control.
Safety case and delivery processing — 9 September 2026
- Reports include a case reference. A case preserves up to 50 relevant conversation messages and associated attachments; it is not an unlimited conversation archive. Only authorised moderators using two-step verification can view retained evidence. Access and hold changes are logged.
- Account deletion disables the account first and records a retryable deletion job. Failed or interrupted processing retries; completion records expire after 30 days. A delay does not return the account to discovery.
- Message attachments are immutable. Unsent uploads are eligible for cleanup after 24 hours. Delivered attachments follow conversation retention or the restricted-case period where copied as report evidence.
- Sent date/event notification queue records expire after seven days. Delivery to a device is subject to permissions, preferences, quiet hours and provider availability; in-app records remain the source of truth.
- Case hold changes require a documented reason. A hold does not grant access to unrelated private notes, calendars or verification records. Only evidence relevant to a case should be preserved.