Data retention and deletion
This page is the operational retention schedule for the beta. It describes what the system actually does, including the parts that are less convenient to admit.
Where data lives
- Cloudflare D1 — accounts, sessions, permissions, quota counters, job metadata, aggregate metrics, report metadata, audit records, AI token/cost aggregates.
- Processing node (VPS) — an isolated per-job workspace while a job runs, the market-data cache, the Telegram session credential, and temporary report files.
- Not stored anywhere — raw messages, extracted signals and individual trades in the application database, analytics, permanent logs or backups.
Retention table
| Data | Where | Retention | Deletion |
|---|---|---|---|
| Account, password hash, sessions | D1 | Until account deletion; sessions expire after 7 days | Deleted with the account; expired sessions are removed |
| Activation status, permissions, per-user limits | D1 | Until account deletion | Deleted with the account |
| Job metadata, status, sanitised error codes, timestamps | D1 | Until account deletion | Deleted with the account |
| Aggregate result metrics (win rate, expectancy, counts) | D1 | Until account deletion | Deleted with the account |
| Daily quota counters and covered months | D1 | Rolling operational history | Deleted with the account; older counters pruned |
| Report metadata (id, size, checksum, expiry) | D1 | Until report deletion | Marked deleted when the file is purged |
| Report body (metrics + individual trades) | VPS temporary store | 24 hours by default, configurable by the operator, or earlier on request | Cleanup worker deletes the file, then records deletion in D1 |
| Raw messages, extracted signals, per-job database | VPS per-job workspace | Duration of the job only | Deleted on success, failure or cancellation; startup and periodic sweeps remove leftovers |
| Market data (candles) | VPS cache | Long-lived; contains no user or channel content | Retained as reference data |
| Telegram session credential | VPS secret file, mode 0600 | While the service operates | Revoked and deleted when the service is retired |
| Administrative audit records | D1 | Long-lived security record | Contains actor, action and target identifiers only — never message text or credentials |
| AI token and cost aggregates | D1 | For budget control | No prompt or message content is stored |
| Application logs | Edge and VPS | Short rolling window | Structured, sanitised; message text and secrets are excluded by design |
Cleanup and verification
A cleanup worker runs on the processing node at startup and on a timer. It removes workspaces older than the job timeout, expires report files past their deletion time, and records purge events. The edge scheduler also expires report metadata and asks the node to delete the file before marking a report deleted; if the node is unreachable the deletion is retried rather than assumed.
The repository includes automated tests that run a synthetic job end to end and assert that the workspace, its temporary database and the report file are gone when the job completes, fails or is cancelled.
Limits of this schedule
Infrastructure providers may retain disk snapshots or network logs outside our application control, and backups of core account data may persist for a short rotation window after deletion. We do not claim that data disappears from every layer of every provider at the moment you press delete. We do claim that channel content is not written to our application database or backups, and that temporary artefacts are actively deleted and their deletion is recorded.
Request deletion
To delete your account or a specific report, use the dashboard or contact @backtester_admin. Deleting an account removes the reports it owns from the processing node as part of the deletion sequence.