Retention and deletion

What QUILLSTAGE keeps, for how long, and what happens when you ask for deletion. Schedule version 2026-10-01-rc1; these are first-party targets proposed by counsel, to be verified against the deployment before the public beta.

• Active projects. Content is kept while needed for your active projects and requests.
• After an accepted deletion request. Access is disabled promptly. Ordinary project copies are deleted from active storage within 30 days; associated backups expire within 35 further days.
• Security logs. Routine security logs are kept 90 days.
• Inactive accounts. Reviewed after 12 months, with 30 days' notice before ordinary closure.
• Incident and legally required records. Kept on separate, documented schedules; we will explain applicable limits.

What a deletion removes

Portraits, masks, voice samples, recorded takes, shots, finished videos and their archives, face embeddings, job state and script copies in the project. What stays: the project's decision record (a hash-chained list of choices and file hashes, no media), the provenance documents, and a tombstone saying what was removed and when.

Service-provider copies, as configured now

• Request payloads at fal (the text and parameters of each request and its output files): fal keeps them 30 days by default. Payload storage is not disabled on our requests at present; a deletion request removes them through fal's payload-deletion API, recorded per request.
• Uploaded inputs at fal (portraits and audio we send to be performed): fal documents no on-demand deletion for these. No expiry is configured at present, so they follow fal's account default (kept until removed); the proposed setting is 30 days with private access, pending counsel's approval after the staging test.
• Other providers through fal (MiniMax, ElevenLabs, VEED): their route-specific retention is not established on our side; see the Service Providers page.

What we cannot promise

Service providers that rendered the performance hold their own copies on their own schedules; we keep each request's identifier until deletion there is done and verified, and we never say a provider copy is gone until it is. Copies you or others downloaded are outside QUILLSTAGE's control.

Request access, correction or deletion through the report form or, for a whole project, from the project's page.