What we keep
What Pollis's servers retain, for how long, what deleting removes — and what cannot be deleted at all.
The important thing to understand is that the main rule is not a timer. An encrypted message envelope is deleted when every current member device has actually collected it — bounded by the slowest device, not by a clock. That is a deliberate choice: a time limit would delete mail belonging to someone who was simply away, and messages must work.
Undelivered messages: bounded by devices, not by time
An encrypted envelope sits on the server only until every current member device of that conversation has reported collecting it. Then it is deleted. There is no maximum age — a message does not expire because it got old.
There is one bound on that, and it is on devices rather than messages. A member device that has not checked in for twelve months stops holding envelopes back for itself. This is not a time limit on messages: a device that checked in yesterday still pins every envelope below its cursor, however old those messages are. And it reverses the moment the device comes back — the device is not revoked or removed from anything.
The consequence, stated plainly because it is a real cost: a device left dormant for more than a year may find gaps when it returns. This is one of exactly three kinds of message loss Pollis accepts, and it is disclosed rather than discovered.
Everything else, and how long it lasts
| What | How long |
|---|---|
| Encrypted message envelopes | Until every current member device has collected them. No age limit. Removed immediately if you delete the message. |
| Reactions | Life of the account; removed when the account is deleted |
| Accounts, group and DM membership, blocks | Life of the account; removed when the account is deleted |
| Security events device added, device rejected, identity reset |
90 days. Long enough to investigate something you noticed late; short enough that it is not a standing record of when you change devices |
| Push notification tokens | 180 days since the device last refreshed, or until the account is deleted. Apps re-register on launch, so a device in use refreshes long before this |
| Per-device delivery cursors | Kept, deliberately. These are what stop undelivered mail being collected early, so removing them to save space would risk deleting messages. Removed with the device, and when you delete your account |
| Attachments | Reference-counted: an encrypted file is collected once no surviving message refers to it. No timer |
| Encryption group state and commit history | Pruned to what the slowest member still needs, with a per-conversation cap so one permanently absent device cannot grow it without limit |
| Your published identity-key history | Never deleted. This is the record that lets your contacts prove your key did not change behind their back — deleting it would remove a protection, not restore privacy |
| Downloaded media on your own device | Encrypted, capped at 500 MB, oldest evicted first |
IP addresses
No client IP address is written to any database, log or table. IPs are read to enforce rate limits and held in memory only — a counter that does not survive a restart. The relay reads a peer address for the same reason and stores nothing.
Stated honestly rather than buried: our edge provider necessarily sees your IP, as does any network between you and us. The optional relay overlay exists precisely to hide your IP from our own services, and it is off unless you turn it on. This section describes what we retain; it does not claim our providers see nothing.
What deleting your account removes
Deleting your account removes your user record, your devices and their delivery cursors, your membership of every group and DM, your reactions, your invites and join requests, your blocks, your settings, your account-recovery blob, your push tokens, your security events, your custom emoji and your undelivered envelopes. Each of those is removed by name, in one transaction, rather than left to the database to work out.
A group or DM you were the last member of is torn down with you: its channels, its stored envelopes, its invites and its encryption state all go. A conversation that still has other people in it stays, minus everything that identified you — and if you were its last admin, someone else is promoted so the group is not left ownerless.
Entries in the public transparency ledger. Pollis publishes append-only Merkle logs so that nobody — including us — can rewrite history behind your back. That property only exists because entries are permanent, so deleting an account cannot remove past entries. The tension is real and the resolution is to publish less rather than to promise deletion we cannot perform: the conversation and sender identifiers in the commit log are replaced with rotating pseudonyms, so an outside observer cannot build a long-term map of who talks to whom. Your identity-key history remains deliberately identifiable, because looking a person up by name is the entire point of key transparency.
Your encryption commits in a conversation that outlives you. A group's encryption history is a chain, and every remaining member walks it to catch up. Cutting a departed member's links out of the middle would strand everyone still in the group, so those entries stay for as long as the conversation does — and are deleted the moment it is. They contain no message content and, in the published ledger, no lasting identifier for you.
Messages already delivered to other people's devices. They are in recipients' local encrypted databases. There is no mechanism to reach them and no backup of history anywhere.
Our providers' own operational records. Edge logs, platform logs and notification delivery records are governed by those companies' policies. See subprocessors.