Record Retention Policy

Last updated: July 28, 2026

We keep data only as long as it’s needed for the purpose it was collected, and no longer. Because DoseForge is designed so that your health records live on your device, most “retention” is simply under your own control. This page describes how long the few categories of data touch each system, and how to have anything deleted.

Data on your device

Your protocols, doses, measurements, photos, labs, symptoms and notes are retained on your device until you delete them. You can remove any individual entry, erase all app data from within Settings, or uninstall the app to remove everything. Documents are stored encrypted at rest.

Your private cloud sync

If you enabled sync, copies live in your own Apple iCloud or Google account and follow that provider’s retention and deletion behavior. Deleting an item in the app removes it from your synced devices; we have no access to this store and cannot retain it.

What our backend holds, and for how long

The optional cloud features keep the minimum necessary, tied only to your random device identifier (never your name or email):

AI analysis cache: de-identified request/result text is cached briefly (short-lived, auto-expiring) to speed up and cheapen repeat requests, then purged automatically.
Usage counters & credit ledger: a running credit balance and a record of credits granted, purchased and spent are retained while your device’s balance is active and for as long as needed for billing accuracy, accounting and fraud prevention.
Payment records: card payments are handled by Square; we retain only a minimal, card-number-free record of a purchase (amount, date, status) tied to your device identifier.
Household sharing: the shared pool is stored as encrypted ciphertext we cannot read. Removing an item or leaving a household tombstones it; deleting the household removes its records. The append-only ledger is retained while the household exists so remaining amounts stay correct, and can be compacted.
Dexcom connection: the access/refresh tokens are retained only while your connection is active. Disconnecting in the app, or revoking access in your Dexcom account, removes our ability to use them and the stored tokens are deleted.
Support tickets & feature requests: retained while we work the request and for a reasonable period afterward to track resolution and product history.
Push tokens: the device token used to wake the app for household updates is retained while the feature is enabled and rotated/removed as the OS reassigns it.

Backups & logs

Operational backups and short-lived system logs may transiently contain the limited backend data above; they roll over on a routine cycle. Logs never include secrets, card numbers, or the contents of end-to-end-encrypted household records.

How to request deletion

For on-device and synced data, delete it yourself in the app. For anything held on our backend — a Dexcom connection, a credit ledger, support history, or a household — disconnect/leave it in the app, or email hello@doseforge.app from the context of your request and we will delete it. Because we don’t collect your identity, please include your in-app device identifier (Settings → About) so we can locate the right records.

Contact

Questions about retention or deletion? Email hello@doseforge.app.