# What we store

The complete list of everything a Kraftify account holds. Each row exists because something depends on it, and nothing is collected on the side. If a row below surprises you, that surprise is the point of the page.

## Kept

| What | Why | For |
| --- | --- | --- |
| Your email | Account identifier: sign-in, billing notices, service announcements. Product news only with opt-in | Until you delete the account |
| OAuth profile | Provider username, display name, avatar URL and account ID — only for OAuth sign-ins | Until you delete the account |
| A hash of your password | scrypt with per-password salt. Never stored or emailed back | Until you delete the account |
| Env key names and set-flags | So the console can show what is configured. Values never reach us; no hashes either | Deleted with the account |
| The billing record | Target, node, renewal date. That is the invoice | 7 years, because tax law |
| Sessions | Random ids with a 30 day expiry, so staying signed in works. Expired ones are pruned | 30 days at most |
| Standing and role | Whether the account is active, banned or ended, and what it may do | Until you delete the account |
| Appeals, moderation and domain records | Your words back to us, log entries naming the account, claims and requests | 1 year after the case closes |
| Mail and waitlist prefs | Which of the four mails you want, and the waitlist entry | Until you delete the account or unsubscribe |
| Credits balance | Granted testing money, drawn before anything could be due | Until spent or the account goes |
| Correspondence | Emails you send to legal, abuse, or privacy | Life of the matter plus 1 year |
| Short-lived edge logs | Proxy and rate-limit entries, rotated automatically | Days, not years |

## Never written

| What | Why not |
| --- | --- |
| Env secret values | Key names and set-flags leave your browser. Values never reach us, and there is no endpoint that returns one |
| Console and query output | Streamed to your browser, dropped at the socket |
| Chat message history | Relayed for delivery. No history is stored |
| Crash dumps and plugin telemetry | No agent, no upload path, no setting to enable one |

The env row is the one that should make you suspicious, so here is the whole argument. A database connection string is a credential. It is in the agent that wrote it and in the process that reads it, which means it is already in at least two places we do not control. Storing a third copy here would be the copy we could be asked to produce. So `kraftify_set_env` receives a key and a confirmation, and the value never reaches us.

## Reading your own list

The same manifest is printed by the dashboard, so you can check that it still matches this page rather than taking our word for it.

```
kraftify data manifest
```

## Getting it all deleted

```
kraftify account delete --confirm
```

Targets, their files and their env values go immediately. The billing record stays for the seven years above, because deleting it would be tax fraud rather than a privacy win.