What we keep
What Pollis's servers retain, for how long, what deleting removes, and what cannot be deleted.
The main rule is not a timer. An encrypted message envelope is deleted once every current member device has collected it, so the slowest device sets the pace. A time limit would delete mail belonging to someone who was simply away.
Undelivered messages: bounded by devices, not by time
An encrypted envelope stays on the server until every current member device of the conversation has reported collecting it, and is then deleted. There is no maximum age.
The one bound is on devices, not messages. A member device that has not checked in for twelve months stops holding envelopes back for itself. A device that checked in yesterday still holds every envelope below its cursor, however old. The bound lifts as soon as the device checks in again; the device is not revoked or removed from anything.
The cost: a device left unused for more than a year may find gaps when it returns. This is one of the three kinds of message loss Pollis accepts.
Everything else, and how long it lasts
| What | How long |
|---|---|
| Encrypted message envelopes | Until every current member device has collected them. No age limit. Removed immediately if you delete the message. |
| Reactions | Life of the account; removed when the account is deleted |
| Accounts, group and DM membership, blocks | Life of the account; removed when the account is deleted |
| Security events device added, device rejected, identity reset |
90 days. Long enough to investigate something noticed late, short enough not to be a standing record of your device changes |
| Push notification tokens | 180 days since the device last refreshed, or until the account is deleted. Apps re-register on launch, so a device in use never reaches this |
| Per-device delivery cursors | Kept. They stop undelivered mail being collected early, so aging them out would risk deleting messages. Removed with the device or the account |
| Attachments | Reference-counted: an encrypted file is collected once no surviving message refers to it. No timer |
| Encryption group state and commit history | Pruned to what the slowest member still needs, with a per-conversation cap so one permanently absent device cannot grow it without limit |
| Your published identity-key history | Never deleted. It lets your contacts prove your key did not change behind their back |
| Downloaded media on your own device | Encrypted, capped at 500 MiB, least recently used evicted first |
IP addresses
No client IP address is written to any database, log or table. IPs are used for rate limiting only, and even in memory they are held as a one-way keyed hash whose key is random, never stored, and gone at the next restart. Our edge strips your IP before the request reaches our servers, which receive only that hash. The relay and the call server work the same way: the relay keys its limits on a hash, and the call server keeps no logs. Device names name the system ("macOS desktop"), and any IP-shaped text in one is removed before it is stored.
Our edge provider still sees your IP, as does any network between you and us, and its account administrators can view client IPs in its security dashboards. The optional relay overlay hides your IP from our own services and is off unless you turn it on. This section covers what we retain, not what providers see.
What deleting your account removes
Deleting your account removes your user record, your devices and their delivery cursors, your membership of every group and DM, your reactions, your invites and join requests, your blocks, your settings, your account-recovery blob, your push tokens, your security events, your custom emoji and your undelivered envelopes. Each table is deleted from explicitly, in one transaction, rather than left to database cascades.
A group or DM you were the last member of is torn down with you: its channels, its stored envelopes, its invites and its encryption state all go. A conversation with other members stays, minus everything that identified you; if you were its last admin, someone else is promoted.
Entries in the public transparency ledger. Pollis publishes append-only Merkle logs so that nobody, including us, can rewrite history. That only works if entries are permanent, so deleting an account cannot remove past entries. Instead the logs publish less: conversation and sender identifiers in the commit log are rotating pseudonyms, so an outside observer cannot build a long-term map of who talks to whom. Your identity-key history stays identifiable, because key transparency depends on looking a person up.
Your encryption commits in a conversation that outlives you. A group's encryption history is a chain that remaining members walk to catch up, and removing links from the middle would strand them. Those entries last as long as the conversation and are deleted with it. They contain no message content and, in the published ledger, no lasting identifier for you.
Messages already delivered to other people's devices. They are in recipients' local encrypted databases, which we cannot reach. There is no history backup anywhere.
Our providers' own operational records. Edge logs, platform logs and notification delivery records are governed by those companies' policies. See subprocessors.