Data retention & deletion
This page describes what data Twinbook stores, how long we keep it, how it is isolated per user, and how you (or your institution) can have it deleted. It is written to match how the system actually behaves.
Last updated: 2026-10.
What we store
| Category | Where it lives | Examples |
|---|---|---|
| Account data | Managed database; credentials with our authentication provider | Email, profile, account/tier status. Passwords are stored and verified by our authentication provider — not by Twinbook. |
| Uploaded content | Files in cloud object storage; structure/metadata in our managed database & document store | PDFs, slides, images, notes, problem sets, and the chapter structure extracted from them. |
| Generated study material | Document store & managed database | Summaries, questions, flashcards, notebooks, annotations. |
| Learning memory | Dedicated learning store, keyed by user + space | Concepts encountered, mastery estimates, study sessions, reflections. |
| Usage & audit data | Logs / accounting tables | Authentication events, API activity, per-account AI usage and cost. |
| Financial records | Managed database | Purchase and subscription history. |
How data is isolated
Data is scoped per user and per space (workspace) and enforced on every request:
- Every content and learning-data operation runs after an authentication and access check; queries are filtered by the authenticated user's identity and by the spaces they own or are a member of.
- One user cannot read or modify another user's spaces, content, members, or learning memory. Cross-account access attempts are blocked at the access-control layer (verified by testing).
- Learning memory reads and writes are keyed by user and space, so personalization never crosses between learners.
Deletion
Deleting content or a space
When you delete an uploaded item or an entire space, Twinbook removes:
- the records in our managed database (content blocks, annotations, notebooks, activity, retrieval indexes, and related rows),
- the associated documents in the document store, and
- the underlying files in cloud object storage.
Database relationships are configured to cascade — deleting a space removes its members, blocks, tags, entitlements, and the study/learning rows that hang off them — so deletion does not leave orphaned content behind.
Deleting your account
Account deletion removes your user record from Twinbook's database and your identity from our authentication provider, and cascades to the data tied to your account (your spaces, content, study/activity records, and learning-memory-related rows).
What is retained after deletion (and why)
- Financial records (purchases, subscriptions, refunds) are retained as required for accounting, tax, and dispute-resolution obligations, even after associated content is removed. These are configured to resist accidental cascade deletion specifically so financial history stays intact.
- Operational logs are retained for 30 days and then deleted automatically. These are the service's own request and error logs, kept for security and abuse investigation.
- Administrative audit logs — a record of changes to the cloud project itself, not of your content — are retained for 400 days. This period is set by the cloud provider and cannot be shortened.
- Staged copies of material you are importing are deleted automatically: a document you upload but do not save within 2 days, a file-conversion preview within 1 day, an import you prepare but never confirm within 24 hours, and a cover image you generate but do not keep within 24 hours.
What Twinbook receives through Tito (the ChatGPT plugin)
When you connect Twinbook to ChatGPT and ask Tito to save something, Twinbook receives only what you send for that save, and nothing else from the conversation:
- the text you send — a passage you paste, or an answer ChatGPT wrote that you choose to save (the assistant's own writing is labelled as such on the resulting chapter);
- any link you supply, and the page, document or video captions it resolves to;
- any file you attach in ChatGPT for that save;
- a short cover prompt and the cover image generated from it, if you create a space.
Twinbook never reads your ChatGPT history, and no part of a conversation reaches Twinbook unless you ask Tito to save it. Material you save becomes a chapter in your space and follows the retention rules above. Material you prepare but do not save is deleted on the staging timetable above. The connection can be ended at any time in Settings → Connected apps → ChatGPT; deleting your Twinbook account also ends it.
Retention defaults
- Active account data and content are retained for as long as your account/space is active, so the product works as intended.
- On deletion, the data above is removed from the primary stores promptly, and operational logs that mention the account age out within the 30-day window above.
- Institutional retention terms (e.g., a defined deletion window after contract termination, or a specific retention period for education records) can be set under a data-processing agreement — see FERPA and University readiness.
Memory controls
Today, learning memory is reset by deleting the space it belongs to or your account, or by contacting support. A richer self-serve in-app control — inspect your learning memory and selectively reset it without deleting the whole space — is on our near-term roadmap. We label this honestly rather than implying a control we haven't shipped.
How to request deletion or export
- Self-serve: delete a space or your account from within the app.
- By request: contact us to request deletion or a copy of your data. Institutional customers can arrange bulk deletion/export terms under an agreement.
- Export today: Twinbook can export your notes to PDF, including the drawings and images inside them. Mind-map boards aren't included in the PDF yet. Broader account-level data export is on our roadmap.
To exercise a deletion or export request, or to ask about institutional retention terms, contact us.