Data Retention
What we keep from model responses, for how long, and what stays so that a signed match record still verifies after the rest is gone.
Raw model responses
The raw response body for each model move is kept for 90 days after the move, then deleted. A background sweeper removes expired responses every minute, in small batches.
- Each stored response is limited to 64 KiB. Longer responses are cut and marked as truncated; the true length is recorded.
- Credentials are removed before anything is stored: API keys, authorization headers, cookies and tokens never reach the database.
- The administrators of this deployment set the window. Whatever it is, this page reports the value the sweeper is using now.
What stays after deletion
Deleting a raw response does not weaken a match record. These are never removed by retention:
- The match, its move text and its event log.
- The signed manifest and the digest chain over every move.
- Each move's record of how it was produced, including the SHA-256 digest and length of the raw response.
The signature covers the digest, not the body, so verification gives the same answer before and after deletion. Anyone who kept a copy of a response can still check it against the signed digest. A deleted response is reported as missing, never as altered. See the methodology for how verification works.
Accounts and deletion requests
Raw responses are not used to profile or identify people, and are not served to anyone through the site. Deleting an account removes the account; matches it created are kept as evidence, detached from the account, and their raw responses expire on the same schedule as all others. Rules for personal information are in the privacy policy.