Data Controls

Version 2026-11-02.1 · Effective November 2, 2026

Retention, export, account deletion, and incident-response paths.

Retention

Active account, project, task, audit, workspace, and billing records are retained while needed to provide and secure the service. Execution worlds may be short-lived or hibernated by their provider; adopted project resources and repository history follow their configured storage and Git retention.

Retention decisions depend on whether an account or project is active, whether records are needed to complete an authorized task or resolve a dispute, statutory accounting requirements, security investigations and legal holds. Information must not be retained merely because storage is available. The operator must document the applicable periods and review retained exceptions.

Managed storage has a limit set by the organization’s plan and any storage packs. While an organization is over its limit, for example after a subscription ends or lapses, it can view, download and delete stored data but cannot add more; saving the work in progress of its tasks continues. Its owners are notified when it goes over and 30 and 7 days before deletion. If it is still over the limit 12 months after going over, stored data is deleted, finished tasks’ saved workspaces and older versions first, until it fits. Saved workspaces of done or cancelled tasks are deleted 30 days after the task ends; their committed work remains on their branches. Older versions of project data in managed storage are deleted 30 days after a newer version replaces them, unless a task still uses them; data in a storage bucket an organization connects itself keeps every version.

Account deletion is an operator-reviewed process, not an automatic purge triggered by subscription cancellation. Backup copies and data held by connected services require separate handling. An offboarding response must identify retained categories, their reason and applicable period or expiry criteria rather than promise immediate deletion everywhere. Retention exceptions must be reviewed and ended when their purpose no longer applies.

Provider backup retention and local application-backup retention are separate. Deleting active data does not instantly erase historical backups. Retained copies must be restricted from ordinary use, expire under the applicable backup cycle, and have completed deletion requests reapplied before restored data is returned to service. Backups do not preserve all external services or live sandbox state.

Export

A signed-in user can download a personal JSON archive from Profile → Your data. Organization administrators can export organization records from Settings. Repository data remains exportable through its repository host; adopted resources should be downloaded before deletion. Contact support for a business offboarding export if the online exports are insufficient.

Account deletion

Request deletion from Profile → Data & account. The online request records the time and gives the configured privacy contact. Cancel an active subscription first. The operator must verify authority, address organizations or resources that need a new owner, and confirm the deletion scope before irreversible removal.

Deletion removes or de-identifies the requesting account and customer-controlled data that no other customer must retain, subject to the limited retention reasons above. The response will identify anything that cannot yet be deleted and why.

Security incidents and privacy requests

Use the configured incident address for urgent suspected compromise and the privacy address for data-subject requests. Do not place credentials, private keys, or unnecessary repository content in the initial message.