Data deletion & retention

Beta draft. This page describes the current deletion and retention model. Some server-side self-service deletion tooling is still in development (marked roadmap below); formal data-processing terms will be finalized before the design-partner beta.

Where your data lives

Memory — free and paid — is stored at rest on your machine (local PGLite, default ~/.corsoul/db). Paid cloud consolidation does not change this: it transiently uploads only the working set for a single Sleep run and discards it afterward, with zero server retention.

Three states of removing a memory

• forget (reversible tombstone) — stops a memory from surfacing in recall, while the underlying Layer-0 raw event stays immutable and restorable. This is the default "remove" semantic.
• Hard-delete local data — you fully control the local database file. Deleting the data directory ~/.corsoul/db (Windows: %USERPROFILE%\.corsoul\db) permanently removes all memory on that machine. Removing the npm package does not delete data.
• Irreversible per-item purge (roadmap) — a tool to permanently erase a single node and its raw events in place is not yet offered; it is planned and will ship alongside the data-subject-request (DSAR) flow.

What the server stores, and how to delete it

• No memory content is stored. Paid consolidation working sets are used and discarded. The server keeps only operational metadata: a metering ledger (timestamps, deep points, token & cost estimates), license↔scope bindings, device bindings, and daily quota counters.
• Release a scope — you can unbind a scope from its license (freeing the slot); that scope's usage then stops counting toward the account.
• Delete operational metadata — currently handled by contacting us (support@corsoul.com or your dedicated contact). A self-service DSAR / one-click hard purge is on the roadmap.

Retention

• The metering ledger is retained for billing and audit (interim 12 months during beta; the final period is set at terms finalization).
• License / device bindings are retained for the life of the binding; released bindings are cleaned up in the next settlement cycle.
• All of the above is metadata and does not include your memory text.

Export

Local data is yours — back up the data directory directly. Structured export tooling is in the docs; reuse the same scope name to carry continuity across machines.