Draft, updated 20 Oct 2026. Companion to the privacy policy. Not a substitute for legal advice.

Data retention and deletion

Last updated: 20 Oct 2026.

This is how long we keep different kinds of data, so the homepage promise — photos are not kept forever — has a real rule behind it.

What we keep

• Raw uploaded photos — deleted 30 days after the order ships, or immediately on request once the book is finalised. If an order is cancelled or refunded before it ships, photos and the print file are deleted 30 days after that. If you never complete an order, deleted after 30 days of inactivity. We email you 7 days before an unused book is deleted.
• Final print file — kept for 12 months after shipping to support reprints, then deleted.
• Account details (name, email, shipping) — while the account is active; deleted after a closure request, except records we must keep for tax.
• Order and transaction records — at least 5 years, even if you ask us to delete the account. We can delete photos without deleting the fact a transaction happened.
• Support email — 2 years.

Our processors

Anthropic: API copies are not used for training by default and are deleted from their backend within 30 days, unless flagged for safety review (up to 2 years).

Prodigi: production files are kept as long as needed for print, quality, reprints, and support, then deleted. Order/shipping records follow their own tax and dispute rules. Tripleaf cannot force an exact deletion date once an order has shipped.

Stripe: payment data stays with Stripe under their terms.

Supabase (Sydney, Australia): the database and sign-in, plus photo copies for older books, for as long as this policy says we keep them.

Cloudflare R2 (Asia-Pacific): photos for newer books, for as long as this policy says we keep them.

Render: the site, hosted in Singapore, including a book while it is being made.

Cloudflare: DNS, and the country hint on a visit.

Resend: the emails we send about an order or an account.

Google Workspace: the support inbox.

Asking us to delete

Email contact@tripleaf.app. We will:

1. Delete your raw library and finished print file within 7 business days of a verified request, or once an in-progress order ships.
2. Delete account details except the minimum transaction record the law requires — and tell you what we keep.
3. Confirm by email when it is done.

Deleted data may remain in encrypted backups for about 30 days. Anthropic’s 30-day window means a photo you asked us to delete today may still exist on their backend for up to 30 days.