EZHomePing Get EZHomePing

Retention schedule

Everything we keep, for how long, and what deletes it. Part of our privacy policy.

Last updated: October 20, 2026

How long EZ Software Labs keeps what EZHomePing holds, and what deletes it. A period is when something falls due. Our servers delete what has fallen due every 15 minutes, so it is gone within 15 minutes after, unless they are down. A free circle's locations are the one exception: they are deleted six hours' worth at a time, checked every hour, so each is gone within 7 hours of falling due.

Locations and what is shared with a circle — encrypted on the phone; we cannot read any of it

Data Kept How it is deleted
Shared locations (fixes) The circle's plan: Free 1 day, Plus 14 days, Pro 30 days, Max 60 days, plus a 1-day margin; gone within 24 hours after. When a plan ends or moves to a smaller one, the new plan's period applies to what is already kept, from when the change is final: after the store's grace period and the 72 hours a renewal is given. A location already past its circle's period when it arrives is not kept at all A free circle's are kept apart, and the database drops them by the six-hour chunk once they are 2 days old, checking every hour: never before they fall due, at most 7 hours after. A paid circle's carry their expiry from the moment they arrive, and the servers' purge deletes them; a downgrade stops anyone reading them at once, and the purge deletes what the smaller plan no longer keeps on its next run
… backstop Nothing older than 61 days, whatever the plan The database drops it, whatever else happens
Alerts (SOS, arriving and leaving, a possible crash, hard braking, a low battery) As locations, by the same plan The servers' purge, as for a paid circle's locations, whatever the plan
… backstop 90 days The database
Who saw an SOS ("I've seen it") With the SOS The same purge
Drives on Max (each drive's route, speeds, hard brakes, speeding, phone handling and score, as one record per circle) The circle's plan, Max 60 days, plus a 1-day margin; gone within 24 hours after. When a circle leaves Max, none, from when the change is final. A driver's drives leave a circle with them The servers' purge; a membership's end
… on the driver's phone, while a drive lasts Until the drive's record is sent, at most a day after it ends; forgotten at sign-out, or if the plan is no longer Max The phone, under a key that never leaves it
A note on a drive ("I was a passenger") With the drive As the drive
Places, circle names While the circle exists; a place deleted in the app is removed Account and circle deletion
Sealed circle keys While the phone and the circle exist With the phone and the circle

Account and service records

Data Kept How it is deleted
Account: name, email address, phone number, birth month and year, country Until the account is deleted Deletion runs 7 days after it is asked for — a pause the person can cancel — and completes within minutes after that, well inside 30 days
Phones: model, system and app versions, last seen Until removed, and the account deleted Deletion
Sign-in codes: the keyed hash of the email address or phone number a code went to, the code's own hash, when it was asked for, and the network it came from (the first part of the internet address, never all of it) 24 hours after it was asked for; sooner if the account it went to is deleted The servers' purge; deletion
A link that undoes a change of your sign-in address, sent to the old address: the link's hash and the keyed hash of that address 7 days after the change, used or not; sooner if the account is deleted The servers' purge; deletion
Abuse counters: how many accounts were made from one network or at one email domain (as keyed hashes), and how many codes were asked for from one network, for one address, number or account, to one email domain (as a keyed hash) or from one block of networks 24 hours after the first one counted; the counts of codes, 1 hour at most They expire in the cache
Sessions: a phone's current refresh token (only its hash), when it was issued and when it expires Until the phone renews it — about every 20 minutes while in use — or 90 days if it never does Its lifetime; the renewal replaces it
… a refresh token once it ends: replaced at a renewal, expired, or its session ended by a sign-out, the phone's removal, support signing the account out, or a reuse caught 24 hours after it ended, so that a copy presented again is caught as a reuse; sooner if the account is deleted The servers' purge; deletion
Subscriptions, as the stores report them Until the paying account is deleted Deletion. The stores take the payment and keep its details; we hold none
Store notifications: what Google Play and the App Store send when a subscription changes 30 days after it arrived, including after the account is deleted: longer than either store sends one again The servers' purge
Low-battery alerts someone turned off: who, about whom, in which circle Until either of them leaves the circle, or an account is deleted A membership's end; deletion
Quiet-phone alerts someone asked for: who, about whom, in which circle, and when they were last told that phone went quiet Until either of them leaves the circle, or an account is deleted A membership's end; deletion
A parent's consent through the App Store or Google Play, for a teenager where a law has the store ask: whether it stands or was withdrawn, and their answer on our significant changes Until the teenager turns 18, or the account is deleted The servers' check at 18, every minute; deletion
The identifier the store gave EZHomePing on that teenager's phone, as a keyed hash only The same The same
A teenager's account whose parent withdrew consent through the store Until the guardian or the account deletes it, or consent is given again [a shorter period, if counsel advises one] Deletion
Installs Google Play lists as revoked by a parent, which we enter from Google Play's own list, as keyed hashes 90 days after they were entered, as long as Google Play lists them The servers' purge
Who may see a driver's drives: who, whose, in which circle, and who chose Until either of them leaves the circle, or an account is deleted A membership's end; deletion
Consent records Until the account is deleted Deletion
Diagnostics a person sends 30 days The servers' purge
Daily counts of locations per circle and member (a number, never a location) 90 days The servers' purge
A copy of someone's data, once ready 7 days The data-request processor
Requests for a copy, or to delete an account Until the account is deleted Deletion
Closed-beta invitations never used 30 days after they are revoked or run out; a used one goes with its account The servers' purge
Email to us — to support@ezsoftwarelabs.com or privacy@ezsoftwarelabs.com, or through the website's contact form, which keeps none of it As long as we need it to answer, then 3 years Deleted from our mailbox
Misuse reports Until support closes them; then 1 year. A report outlives the accounts in it, with them removed from it The servers' purge; deletion removes the person
Audit log: what staff and the service did, and why — every staff look at personal data with its reason 1 year, then deleted. A deleted account's entries stay until then, with the person replaced by a placeholder The servers' purge, through the one database function that may delete an entry, which refuses anything younger
What each run of the servers' purge deleted: how many rows of each kind, and up to when — never whose 1 year, as the audit log The servers' purge, through the one database function that may delete it, which refuses anything younger

Law-enforcement requests

Data Kept How it is deleted
A request from a government agency: what was asked, the legal process, our review, what we produced and why Until the later of 7 years after we are done with it, and 2 years after the later of our telling the account holder and the end of a court's order not to tell them. Done with it: we refused it, the agency withdrew it, it proved forged, or we answered it or its preservation ended, and nothing we produced or preserved for it is still kept. While an order not to tell names no end, until we have told them By hand, on the day it falls due: until our portal takes requests, they reach us by email or by service, and are kept apart from the service
A preservation copy: what we hold about an account named in a preservation request, as it stood when the request arrived 90 days from the request, and 90 more once if the request is renewed; it outlives the account's own deletion for that time At the end of its term, or at once when the agency withdraws the request or it proves not genuine

Copies kept to run the servers

Data Kept How it is deleted
Server and proxy logs: requests, with the network part of the internet address (never all of it) and no query strings; failed requests with their address; never a location Up to 30 days The system journal keeps 30 days; the web server's logs rotate daily and keep 14. Our services' logs are also kept in Google Cloud Logging, up to the same 30 days
Database backups Up to 30 days. Something deleted can survive in a backup until that backup is gone Nightly copies on the server are kept 7 days; copies off the server are deleted at 23 days and recoverable for 7 more; disk snapshots are kept 7 days
The encryption keys for our database For as long as the data they protect Kept apart from the database and its backups