Data Retention & Deletion Policy
Last Updated: October 16, 2026
Soft-Delete → Hard-Delete Workflow
- Deactivation (Soft-Delete): Flagged immediately; access suspended.
- 30-Day Restore Window: Log back in within 30 days to restore.
- Permanent Deletion: After 30 days, all personal data is removed.
- Legal Holds: Core records (billing, tax) kept longer as required.
Check-In Data and Children
Check-in data is not one kind of record, so it is not kept for one length of time. A photograph taken at the door exists to confirm the right adult collected the right child that day; once collection is done its purpose is spent, and it is deleted from storage rather than merely unlinked. The record of who was collected, by whom, and when is a safeguarding document, and it is kept for years.
A church may lengthen any of these windows to meet its own child-protection policy or its insurer's requirements. It cannot shorten them below the minimums published here. Records tied to a reported incident, or under a legal hold, are exempt from every schedule — including the church's own — and are kept until the matter is resolved. Every sweep is logged, so a church can show what was removed and when.
Retention Schedule
| Data Category | Retention Period | Notes |
|---|---|---|
| Check-In Photos | 7 days (church may extend) | Images captured at check-in and check-out, including the drop-off photo a parent takes on arrival. Deleted from storage, not just unlinked. |
| Check-In Records | 7 years (church may extend) | Who was checked in, who collected them, and when. Kept as a safeguarding record. |
| Pickup Records | 7 years (church may extend) | Who collected each child, on what proof, any override reason, and how long any child waited past pickup time. Removed with the check-in records they belong to. |
| Family Follow-Up Notes | 7 years (church may extend) | Whether a team member has welcomed a new family, or reached out to a regular family who stopped coming, by whom, and any note they kept. Deleted on the check-in record schedule, or when the family deletes their account. |
| Pickup Passes | 30 days after they expire | A pass stops working once the children are collected, or within 24 hours. Shared passes include the email address they were sent to. |
| Authorized Pickup Adults | Until the guardian removes them | Name, relationship, photo and optional email a guardian provides. Deleted when the guardian removes them or deletes their account. |
| Pickup Alerts | Until the church removes them | Notes a church’s administrators keep on who must not collect a child. |
| Parent Messages | 2 years (church may extend) | Messages between a worker and a parent during a service. |
| Prayer Requests | 2 years (church may extend) | Requests submitted to a church’s prayer team. |
| Background Checks | 7 years (church may extend) | Submitted background-check records evidencing who was cleared to serve. |
| Attendance Totals | Retained | Counts per service, carrying no personal detail. |
| OTP Codes | 10 minutes | Expires automatically. |
| Chat Messages (first 1K) | 90 days | Only first 1,000 chars stored. |
| Soft-Deleted Accounts | 30 days | Can restore before permanent deletion. |
| Hard-Deleted Accounts | Permanent after 30 days | All personal fields wiped; backups purged after 1 year. |
| Billing & Invoicing | 7 years | For tax/legal compliance. |
| Giving & Donation Records | 7 years | Set by the platform for statutory reasons; not a church setting. |
| Activity Logs | 7 years | The audit trail of administrative actions. Set by the platform. |
| Cookie & Analytics | 30–365 days | Aggregated analytics up to 1 year. |
| Devotional Reading Progress | Until the member removes it | The day someone started a reading plan, their reminder time and time zone, and which devotionals they marked as read. Stopping a plan removes its start and reminder; unmarking a devotional removes that mark. Deleted when the member deletes their account. |
What Happens on Permanent Deletion
- Profile data erased
- Messages purged
- Registrations & Donations removed
- Backups & Logs destroyed after 1 year
Your Options & Rights
- Restore: Log in within 30 days to undo deactivation.
- Download: Request your data via contact@churchservicehub.com.
- Erase check-in history: Ask your church to remove your family’s check-in records ahead of the schedule. Photographs are deleted from storage, not just unlinked. Records a church is required to preserve — those tied to a reported incident or under legal hold — are kept until that obligation ends, and your church can tell you which apply.
- Delete: After 30 days, all data is gone.
- Privacy Policy: See Privacy Policy.
Questions? Contact contact@churchservicehub.com.
Church Service Hub LLC5900 Balcones Drive, Suite 20105
Austin, TX 78731, United States
Phone: +1 (512) 434-0354