Data retention and disposal policy
Last updated 19 October 2026 · Next review by 19 October 2027
This policy sets out how long Goose (got-goose.com) keeps each kind of data, and how that data is deleted when the time comes. It applies to everything Goose stores, including bank data received from Plaid. It sits beside the privacy policy, which says what Goose collects and why.
Owner: Michael Bailey, who runs Goose. Questions and requests: michael@mrjb.co.uk. Security matters: security@got-goose.com.
Principles
- Keep only what the app needs. Goose keeps your data to run your budget, and for no other purpose. Nothing is sold, shared for marketing, or used for analytics.
- Your data lives as long as your account. You decide when it goes, and deleting your account deletes it straight away.
- Copies expire on a schedule. Every backup has a fixed lifetime, so no copy outlives the policy below.
- Deletion reaches third parties. When access you granted ends, Goose tells the provider, so no connection outlives your consent.
How long each kind of data is kept
| Data | Kept for | Then |
|---|---|---|
| Your sign-in (email, name, Google/Apple identity) | While your account exists | Deleted when you delete your account |
| Your budgets: accounts, transactions, categories, payees, notes, targets | While your account exists | Deleted when you delete your account, or line by line whenever you delete them |
| Bank transactions from Plaid or a bank's Google Sheet | As part of your budget, while your account exists | Deleted with your budget. Disconnecting a bank stops new data arriving but keeps the history you already have, until you delete it or your account |
| Plaid access tokens | While the bank stays connected | On disconnect or account deletion, the token is erased and the connection is closed at Plaid (/item/remove) |
| Google access (refresh token for the sheets you picked) | While Google stays connected | On disconnect or account deletion, the grant is revoked at Google and the token erased |
| Receipts and bank statements you upload | Until you delete them, or your account | Deleted from storage |
| Bill-reminder (push) subscriptions | Until you turn reminders off, or delete your account | Deleted |
| Sign-in session | 30 days, or until you sign out | Expires |
| Assistant connections you approve (e.g. Claude) | Until you disconnect them in the assistant, or delete your account | Revoked |
| Nightly backup of each budget | The 45 most recent (about six weeks) | Older copies deleted automatically each night; all of a budget's backups deleted when the budget is deleted |
| Database point-in-time recovery (Cloudflare D1 Time Travel) | Up to 30 days, managed by Cloudflare | Expires automatically; used only to recover from a fault |
| Database snapshot taken before each release | 14 days | Expires automatically (private, access-controlled GitHub storage) |
Goose keeps no analytics, tracking or advertising data, and does not store request logs.
Deleting your account
Your profile → Delete account removes, straight away:
- your sign-in and identities;
- every budget only you belong to, with its transactions, receipts, statements and backups;
- your bill-reminder subscriptions and assistant connections;
- your bank connections, which are closed at Plaid, and your Google grant, which is revoked at Google.
A budget shared with someone else stays with them: you leave it, and nothing in it is deleted. If you own a shared budget, Goose asks you to remove the other members or hand it over first, so your deletion never takes someone else's data.
The only copies that remain afterwards are the short-lived ones in the table above: point-in-time recovery (at most 30 days) and pre-release snapshots (14 days). Both expire on their own and are never restored except to recover from a fault.
How data is disposed of
- Database rows are deleted from Cloudflare D1. Related records go in the same operation.
- Files and backups are deleted from Cloudflare R2.
- Tokens are erased and, where the provider supports it, revoked at the provider.
- Storage media are Cloudflare's. Cloudflare encrypts all data at rest (AES-256) and disposes of media under its own certified procedures.
- Goose keeps no copies of user data on personal devices.
Requests
You can export your whole budget at any time from the app. Under UK data protection law you can also ask for a copy of your data, or for it to be corrected or deleted. Email the address above, and Goose will answer within one month.
Review
This policy is reviewed at least once a year, and whenever Goose starts keeping a new kind of data or changes how long it keeps one. The date at the top changes with each review.