Data Retention & Deletion Policy

What account deletion does

Open Profile or Settings and choose Delete account. Read the consequences, confirm the permanent request and follow any sign-in prompt. If the app reports incomplete cleanup, follow its retry guidance or contact support@clavisplus.com. If you no longer have the app or cannot sign in, contact support with the account email and a safe way to respond. Never send a sign-in code.

Identity, photos, social records and scores

While an account is active, its identity links sign-in, profile, friendships and competition participation. The deletion flow removes the profile and authentication identity in stages and attempts to purge avatar objects. It closes all active sessions you own. A remaining co-organizer can inherit ownership of closed session records; otherwise ownership is released.

It removes join requests from that account, detaches or clears specified organizer and actor references, and relabels linked session participants “Deleted player.” Account-linked friendship and ranking participation records are subject to database deletion rules. A participant’s departure can change other players’ recalculated standings. Shared scores, bracket progression, attendance, closed session history and some command payloads may remain.

How long and why

Account and profile data serve ongoing access. Replace or remove outdated photos promptly. Keep session and result detail only as long as needed to operate the session and resolve justified corrections or disputes. Identifiers are reviewed separately from team totals. Minimal sign-in, security and audit evidence is kept only for a defined investigative or legal purpose. Inactive accounts, undelivered notifications, expired keys and invitations are subject to an expiry review. We identified no behavioral analytics dataset to retain.

Local archives, exports and backup recovery

Local archives on the device are separate from a connected account. An exported JSON file can include other people’s names and scores. Account deletion cannot recall exports or remove a recipient’s copy. Use device controls to remove app data and delete exports you control, after considering other players’ rights. On restore, outstanding deletions are reapplied before restored data is made available to users.

Deactivation, erasure and preserved records

Signing out ends a session. Deactivation would suspend access while keeping data; a separate account-deactivation feature has not been verified. Deletion removes specified records and identifiers. Archival moves records out of normal use while retaining them. Replacing a label or removing an account link can leave identifying details in a small match, a recorded reason, a notification or a backup. These are treated as personal data wherever a person can reasonably be identified, and the term “anonymous” is used only after verifying that re-identification is no longer reasonably possible.

Specific requests and legal holds

Ask support to review a named match, photo, guest entry, correction reason or retained copy. Give a session reference and explain the concern. We will verify the requester proportionately, locate relevant records, consider the rights of other participants, and explain erasure, restriction, correction or any justified refusal.

Where a binding duty or legal claim requires preservation, we isolate the necessary material, record why and when the hold will be reviewed, and delete it when the basis ends. Erasure is coordinated with contracted processors, with completion or scheduled backup expiry confirmed.

Proposed schedule (pending approval)

The following limits are proposed and not yet in effect: remove replaced photos after a successful swap and verified cleanup; examine closed sessions after 90 days for unresolved disputes and strip unnecessary names; review operational security logs at 30 days and extend only against documented incidents; prompt inactive accounts for review after 12 months, allowing a response before erasure; for provider backups, target a rolling 30-day recovery window only if the provider can support and verify it.