Policy
Goodo Data Retention Schedule
Last updated 11 October 2026
Draft
This document is a draft that is still going through legal review. It may change before Goodo launches.
Draft for legal review — not yet legal advice
This schedule sets out how long Goodo keeps each kind of information, why, and how it is deleted. It supports APP 11.2 (destroy or de-identify personal information we no longer need) in our Privacy Policy. Retention periods marked [TBC] are proposals for legal and privacy review.
Rules that apply to every row
- Minimum necessary. If we do not need it, we do not collect it. If we no longer need it, we delete it.
- Account deletion beats the default period unless a hold applies (section 4).
- Backups are kept for up to 30 days. Deleted data leaves backups as they roll over and is not restored into live systems except to recover from a disaster, after which deletions are re-applied.
- Holds. An open report, appeal, complaint, investigation, police or regulator request, or legal claim pauses deletion of the relevant records until it ends. See the Safeguarding and Incident Response Policy.
- Location: Sydney, Australia (ap-southeast-2) unless stated.
- Never stored at all: identity documents, dates of birth, precise GPS location, contacts, payment card numbers (providers pay through a payment processor).
1. Database tables
Accounts and profiles
| What | Table | Why we keep it | Retention | Deletion method |
|---|---|---|---|---|
| Sign-in identity (email, mobile) | auth.users |
To sign you in | Life of the account. Deleted within 30 days of a deletion request | Hard delete; cascades to profile |
| Profile (handle, display name, bio, avatar path, role, state, status, age-verified flag) | profiles |
To run your account and show your profile | Life of the account. On a deletion request, status becomes deleted and the profile is hidden at once; hard-deleted within 30 days | Hard delete by cascade |
| Organisation details | organisations |
Provider identity, ABN, registration | While any member is active, then 12 months [TBC]. Mostly public business information | Scheduled delete job |
| Organisation membership and authorisation | organisation_members |
Ties a person to their employer | Life of the membership; removed with the account | Cascade |
| Ban record (handle, identity-check reference, date, reason category, ban approver) | [new table needed] | To stop a banned person returning | 5 years from ban [TBC] | Scheduled delete job. Kept after account deletion because credentials cascade away |
| Consent record (what, when, version) | [new table needed] | To show we obtained consent | Life of the account plus 7 years [TBC] | Scheduled delete job |
Verification
| What | Table / bucket | Why | Retention | Deletion method |
|---|---|---|---|---|
| Evidence files (plan cover page, screening clearance, insurance certificate, orientation certificate, authorisation letter, declaration, WWCC) | Storage bucket evidence (private) |
To let a reviewer decide | Deleted 30 days after the decision (verified or rejected). If no decision, deleted 30 days after upload [TBC]. If an appeal is lodged, deletion pauses until the appeal is decided. Deleted at once on account deletion | Daily job removes the file and clears evidence_path. Account deletion removes the folder |
| Credential outcome (status, type, reference number, issuer, issued and expiry dates, reviewer, decision date, rejection reason) | credentials |
To compute badges, prove what was checked, renew on time | Life of the account plus 12 months [TBC] | Cascade on account deletion. Scheduled delete for post-closure data |
| Evidence hash (SHA-256) | credentials.evidence_sha256 |
To prove what was reviewed without keeping the file | Same as the credential row | Same |
| Credential type definitions | credential_types |
Reference data | Permanent | Not personal information |
| Vouches | vouches |
To record who vouched for whom | Life of the vouch (12 months). Revoked vouches deleted after 12 months. Removed with either account | Cascade, then scheduled delete |
| Badges (grants and revocations, reason) | badges |
To show current badges and the history of changes | Life of the account plus 12 months [TBC]. Revocation reasons for conduct stay with the moderation record | Cascade |
| Provider Register snapshot | provider_register |
To match organisations to the NDIS Provider Register | Current snapshot plus the previous 12 months of changes [TBC]. Public data | Overwritten on import. Old snapshot rows deleted by job |
| Register import log | provider_register_imports |
To show which file a decision used | 24 months [TBC] | Scheduled delete job |
Content and social
| What | Table / bucket | Why | Retention | Deletion method |
|---|---|---|---|---|
| Video records (title, description, audio description, thumbnail text, visibility, paid-placement flag, status, moderation scores) | videos |
To publish and moderate | Until you delete the video or your account. Videos removed by moderation: record kept 24 months after removal [TBC] | Cascade on account deletion; scheduled job for removed videos |
| Video files | Storage bucket videos (authenticated) |
To play videos | Until you delete or your account is deleted. Videos removed by moderation: file kept 90 days for appeals, then deleted. Never kept past a hold. Child sexual abuse material is handled only as the AFP and law direct | Storage delete (owner, or staff) |
| Captions | captions, storage bucket captions |
Accessibility | With the video | Cascade; storage delete |
| Thumbnails | Storage bucket thumbnails (public) |
Display | With the video | Storage delete |
| Avatars | Storage bucket avatars (public) |
Display | Until replaced or deleted; deleted with the account | Storage delete |
| Comments | comments |
Social feature | Until you delete them, or the video or account is deleted. Comments removed by moderation: 90 days, then deleted unless held | Cascade; scheduled job |
| Reactions, follows | reactions, follows |
Social feature | Life of the account | Cascade |
| Groups and topic communities | communities |
Run groups | Life of the group. A removed group: 90 days, then deleted unless held | Cascade; scheduled job |
| Group membership | community_members |
Run groups, keep bans in force | While you are a member. Bans in a group stay while the group exists. Removed with the account | Cascade |
| Videos added to communities | community_videos |
Show videos in groups | With the video or group | Cascade |
Events
| What | Table | Why | Retention | Deletion method |
|---|---|---|---|---|
| Event record (title, description, public suburb and postcode, times, accessibility tags, status) | events |
Run events | 12 months after the event ends or is cancelled [TBC] | Scheduled delete job |
| Exact address, online link, join instructions, host contact | event_private_details |
So confirmed attendees can attend | 30 days after the event ends or is cancelled [TBC] | Scheduled delete job |
| RSVPs (status, plus-ones, linked support worker, note to host) | event_rsvps |
Manage attendance | 90 days after the event ends [TBC]; removed with the account | Scheduled delete job; cascade |
| Accessibility tag list | accessibility_tags |
Reference data | Permanent | Not personal information |
Messages
| What | Table | Why | Retention | Deletion method |
|---|---|---|---|---|
| Conversations and members | conversations, conversation_members, conversation_pairs |
Direct messaging | While at least two participants' accounts exist. When both accounts are deleted, the conversation is deleted | Cascade |
| Messages | messages |
Direct messaging | While the sender's account exists. Messages a person sent are deleted with that person's account. Removed or hidden by moderation: 90 days, then deleted unless held | Cascade; scheduled job |
| Filter flags and moderation notes on messages | messages.moderation, messages.flagged_at |
To route messages to staff review | The flag and notes are cleared 90 days after the review ends with no breach found. If a breach is found, they follow the moderation record | Scheduled job |
| Read markers, mute | conversation_members |
Show unread | While the conversation exists | Cascade |
Staff can read a conversation only while it has an open report or a flagged message.
Safety and administration
| What | Table | Why | Retention | Deletion method |
|---|---|---|---|---|
| Blocks | blocks |
Keep blocks in force | Life of the account | Cascade |
| Reports (reason, target, details, outcome) | reports |
Record what was reported and decided | 24 months after resolution. Safeguarding cases (P1 and P2): 7 years [TBC]. Reporter link is removed when the reporter's account is deleted | Scheduled job; reporter link set to null |
| Moderation actions (action, reason, target, expiry, actor) | moderation_actions |
Accountability, appeals, strike counting | Warnings and strikes: 3 years from the action. Restrictions, suspensions, bans and badge revocations: 7 years [TBC] | Scheduled job; the record refers to the account by id only |
| Audit log | audit_log |
Prove who did what to credentials, badges and moderation | 7 years [TBC]. Contains no message content or evidence | Scheduled job |
| Case files and legal-hold copies | [restricted store] | Evidence for regulators, police and courts | Until the hold ends, then 12 months (7 years for serious safeguarding matters or as the law requires) | Manual, recorded deletion |
Location
| What | Table | Why | Retention | Deletion method |
|---|---|---|---|---|
| Postcode and approximate centre of the postcode, suburb, state, whether sharing is on | profile_locations |
"Near me" discovery | While location is on. Deleted within 30 days after you turn it off, and with your account [TBC] | Scheduled job; cascade |
| Postcode reference list | postcodes |
Turn a postcode into an approximate centre | Permanent | Not personal information |
2. Other systems
| What | Where | Retention | Deletion method |
|---|---|---|---|
| Application and API logs | Hosting platform | 30 days. Contain no message content, evidence or identity documents | Automatic roll-off |
| Security logs (sign-in, staff access) | Hosting platform / log store | 12 months [TBC] | Automatic roll-off |
| Analytics events | Analytics tool | 13 months. No personal or sensitive information, no message or video content | Automatic roll-off |
| Error and crash reports | Error tracking tool | 90 days. Personal information removed | Automatic roll-off |
| Push-notification tokens | Database or push service | Until you sign out or uninstall, or 90 days of inactivity | Scheduled job |
| Backups | Hosting platform | 30 days [TBC] | Automatic roll-off |
| Support emails and forms | Email system | 24 months after the last message | Manual or scheduled |
| Identity vendor records | Identity verification vendor | The vendor keeps its own check record for as long as it is legally required to. We require that the vendor delete your document images and face image as soon as the check is complete, and in any event within [TBC] days | Contract term; vendor deletion on request |
| Captioning and moderation vendors | Vendors | We require no retention beyond processing [TBC] | Contract term |
| Transparency statistics | Reports | Permanent. Aggregate and de-identified | Not personal information |
| Inactive accounts | auth.users, profiles |
After 24 months of no sign-in we send notices; if you do not respond we delete the account 60 days later [TBC] | Scheduled job |
3. Deleting an account
When you ask to delete your account, or tell us to:
- Straight away: your profile is hidden, your sessions end, your location is turned off, and push tokens are removed.
- Within 7 days: your evidence files are deleted if any remain, and your videos, captions, thumbnails and avatars are removed from storage.
- Within 30 days: your profile, credentials, badges, vouches, comments, reactions, follows, group memberships, RSVPs, messages you sent, blocks and location are deleted.
- We keep, for the periods above: records we must or may keep for safety or legal reasons (reports and moderation records, audit log entries, ban record, and anything under hold). These refer to your account by an identifier, not your name, and are used only for those purposes.
- Other people's copies: comments or videos that other people made in reply to your content remain, but are no longer linked to you.
- We ask our vendors to delete their copies.
We confirm in the app when the deletion is complete.
4. Holds
Deletion is paused for the specific records involved when:
- a report, appeal, complaint or investigation is open
- police, a court or a regulator asks us to preserve information
- the safeguarding lead believes the information may relate to serious harm or a crime
- we are preparing for, or defending, a legal claim
Each hold is recorded with its reason, owner, start date and review date. Holds are reviewed every 90 days. When a hold ends, normal deletion resumes.
5. Review
The privacy officer reviews this schedule at least once a year and whenever a feature changes what we store. A new table, bucket or vendor must be added to this schedule before it goes live.
Goodo is independent
Goodo is an independent service. It is not affiliated with, run by or endorsed by the National Disability Insurance Agency (NDIA) or the NDIS Quality and Safeguards Commission.