Data Retention and Erasure
Data Retention Policy
Last updated: 3 October 2026 · Version 2.6
This is a courtesy translation. In the event of any discrepancy, the Spanish version prevails.
1. We keep the minimum
Madrugo does not keep a copy of your mailbox. It reads what it needs to build the 24-hour view and, from your mail, stores only what is derived from it: who writes to you, about what, an extract and the memory drawn from it. The full body of an email is not stored as permanent memory; a cryptographic digest is stored instead, to detect whether the message changed.
Copies of your calendar and contacts are stored, and that must be said: the events of calendars by link, encrypted; the events and reminders uploaded by the iPhone app, with their title, dates, location and notes, not encrypted field by field; and your contact book from Google, Microsoft and the iPhone, encrypted.
Before a Memory item is stored, a local filter discards whatever looks like a one-time code, a password, a national ID number, a full phone number, an IBAN or card details. It is a pattern-based filter: it reduces the risk, it does not remove it. It is not applied to reply proposals or to the daily summary, and it does not clean what is sent to the AI model: the privacy policy explains that.
2. How long each thing is kept
These are the periods the code applies. Memory is measured from when the memory was created, not from the last time it was touched: measured from the last touch, pressing a button would extend retention indefinitely.
| Data category | Period | What deletes it |
|---|---|---|
| Credentials for connected accounts (Google, Microsoft, iCloud, calendars by link, Todoist, tokidu) and the linked Telegram chat | For as long as that connection stays active | Microsoft, iCloud, calendars by link, Todoist, tokidu and Telegram: when you disconnect that connection and when you erase the account's data. What was already sent to Telegram stays in the chat and is deleted from Telegram. Google: today only when you erase the account's data, because it has no server-side disconnect yet. |
| Memory derived from mail (sender, subject, extract, memory) | 90 days from when the memory was created | The purge. A memory's own expiry can shorten that period, never extend it. |
| Memory profile (facts, preferences, frequent contacts, style) | Does not outlive the memories it summarises | Rebuilt after every purge, and erased with the account. |
| AI reply proposals (subject, sender, draft) | 90 days | The purge. |
| Stored daily summary, with the cryptographic digest of your IP that goes with it | 90 days | The purge. |
| Contact book (Google, Microsoft and iPhone) | No period: for as long as the account exists | Erased with the account. A contact also disappears when it is no longer at its source on the next sync, or when you exclude it. Resetting memory does not erase contacts. |
| Events and reminders uploaded by the iPhone app (title, dates, location and notes) | No period | An item is deleted when the phone sends a new list that no longer contains it, and all of them with the account. The purge does not touch them. |
| Copy of the events of calendars by link | For as long as the calendar stays added; one-off events older than 30 days are not kept | Erased when you remove the calendar, and with the account. |
| Mail signatures | No period | You delete them, or they are erased with the account. |
| State of daily routines | “Done” marks, 60 days; routines removed from view, no period | Marks are pruned when you mark a routine again, not daily: if you stop using the feature, they stay. Everything is erased with the account. |
| AI usage and spend counters | 60 days for usage; 13 months for spend | Their own pruning, which runs when the server starts, not daily. Also erased with the account. |
| Your account, your edition and your preferences (with the exclusion list and the municipality) | No period: for as long as the account exists | Account erasure. |
| Sync logs | 30 days | The purge. |
| Audit log and finished memory jobs | 90 days | The purge. |
| Record of an account deletion carried out by the administrator (account email, date, reason and receipt number) | 90 days | The purge. |
| Device pairing codes | Valid for 10 minutes and single use; the row, 1 day | The purge. |
| Live Activities table (today the app sends no notification token) | The token is cleared after 30 days unused; the row, after 180 | The purge. |
| Device credentials (digest only, never the token) | 180 days unused, or 180 days after revocation | The purge. |
| Record of the cost of each AI call at the gateway (Sinergia): model, usage and a pseudonym for your account, without the text | As long as the spending accounts need it | It carries nothing that identifies you and nothing you wrote. |
3. How the purge is applied
The purge is a server process that walks those categories, deletes whatever is past its period and rebuilds the memory profile of the accounts affected. It works in batches, can be repeated without harm, and its logs name no account, no subject and no sender: only counts. It does not cover everything: routines and counters have their own pruning, and whatever the table lists as “no period” is not touched by it.
/app/settings you can erase your data at any time, without waiting for any period, and it is immediate.4. What on-demand erasure actually deletes
At /app/settings, typing your email address to confirm, everything Madrugo has stored about your account is deleted in a single operation: memory and profile, reply proposals, stored summaries, contacts, iPhone events and reminders, mail signatures, routine state, sync and audit logs, memory jobs, usage and spend counters, paired devices and the Live Activities table, your account, your edition and your preferences. All credentials are deleted too: the Google, Microsoft, Todoist and tokidu tokens, the iCloud Mail password and the calendars by link. Your identity at Firebase Authentication is deleted afterwards. The operation returns a receipt identifier and a per-table count.
And here is what that button does not do, so nothing takes you by surprise: it does not touch your Gmail, your Outlook, your Todoist or your tokidu — not one email, not one event, not one task — and it does not withdraw the permission you once granted Madrugo at Google or Microsoft. To cut it off from the other side you need to revoke access in your Google or Microsoft security panel.
Nor does it reach two places: what your browser and the apps keep on your device, which is removed from Settings, by signing out or by uninstalling the app; and the database backups, which renew themselves: what you erase disappears from them within 30 days at most.
If the administrator deletes the account — because you ask by writing to [email protected], because the law requires it or because the account was set up by mistake — the same things are erased, by the same operation. The difference is that a record stays in the administrator's log for 90 days: the account email, the date, the reason and the receipt number, so that it can be shown to have been done. When you erase it yourself from /app/settings, no such record is kept.
5. Why “erased” does not always mean “destroyed today”
Article 32 of Spain's Organic Law 3/2018 requires data to be blocked when it is erased: identified and set aside with technical measures that prevent any processing — including viewing it — except to make it available to courts, the public prosecutor or data protection authorities, and only for as long as liability can still be claimed. After that period it must be destroyed.
Today, when you erase something, it is erased from our database at that moment. The one exception is the 90-day record left when the administrator deletes an account, described in the previous section. If the law ever required us to keep a piece of data to prove something before a judge or an authority, we would keep it blocked: not used for anything else — not shown, not passed to AI, not synced — and only for the legal period.
6. If you revoke access from Google, Microsoft or Apple
If you remove the permission from your Google or Microsoft account security panel, or unlink the app from your Apple ID, Madrugo finds a token that no longer works: it can read nothing and flags that connection as down on the next sync attempt. Anything already stored stays until you erase it or its period expires; if you want it gone sooner, use the erasure at /app/settings.
7. Questions about retention
If you want to know what we hold about you, ask for confirmation that it has been destroyed, or ask about any period on this page, write to [email protected] or [email protected]. It is free and we reply within one month at the latest.