Data Retention Policy
Last updated: May 18, 2026
We aim to retain as little data as we need to operate the Service. This page documents exactly what we keep and for how long.
Photos you upload — subscribers
Retention
Up to 365 days, then automatically deleted by a weekly cleanup job. You can delete any report yourself at any time from My reports — the photo, the annotated result, and the audit-log entry are removed in seconds.
Where
Vercel Blob (US-based object storage). Each photo and the AI result are written to a per-customer namespace; nothing is publicly listed.
Encryption
Encrypted in transit (TLS) and at rest (storage provider).
AI provider
Per our AI provider's API policy, prompts and completions are not used to train their models. Their retention is governed by their own published policy.
Your device
Photos remain on your device unless you upload them. The browser holds a preview via a blob URL that is revoked when you remove the photo or refresh the page.
Shareable report links
What it is
An optional link to a read-only, no-sign-in view of one inspection's photos, roof health score, and your branding — for sharing a homeowner report. No insurance, claim, or building-code detail is included.
Retention
The link expires automatically after 90 days. The underlying photos follow the 365-day retention above; deleting the report removes them and breaks the link.
Access
Anyone with the link can open it (gated by an unguessable token, not sign-in), and access is rate-limited. The token is not publicly listed or searchable.
Photos you upload — free trial
Retention
Processed in memory during the analysis request only. Not persisted to disk or any database after the response is returned.
Transit
Sent over TLS-encrypted HTTPS to our API server, then forwarded over TLS to our AI provider.
Property information you enter
Retention
Stored only in your browser's sessionStorage. Cleared when you close the tab.
Sent to server?
No. The form values never leave your device unless you explicitly opt in to a future server-side feature.
Server logs
What we log
Timestamp, IP address, user agent, response status code, request duration, error messages. We do not log photo bytes.
Retention
Up to 30 days for security, abuse detection, and debugging.
Where
Vercel platform logs (US-based).
Analytics
Provider
Vercel Analytics (privacy-friendly; no third-party cookies).
What's collected
Aggregated, anonymized: page views, performance metrics, country.
Retention
Up to 12 months in aggregate form. No individual user profiles.
Deletion requests
Self-serve: open My reports and click Delete on any entry. The photo, the AI result, and the audit log entry are all removed within seconds.
For broader requests (full account deletion, log-line scrubbing tied to your IP, exports), email hello@riptideai.co. We respond within 30 days.