KidBox Retention Policy
Version 1.2 · Effective December 1, 2026 (1.1 adds usage statistics; 1.2 adds Voice recordings)
Moves Media Ltd.
Contact: Blaise Sack, Privacy Officer, info@kidbox.ca
1. Our rule
We keep Personal Information only as long as we need it to run KidBox for your family, or as long as the law requires. Then we delete it. Deleting a recording means deleting the audio file itself, not just hiding it from the list.
Words in capitals have the meanings in our Privacy Policy.
2. How long we keep each thing
| Information | How long | How it is deleted |
|---|---|---|
| Messages and their recordings | 90 days from when they were sent | Automatically, every night at 3:30 a.m. Pacific |
| Recordings the Box could not address (it did not know who they were for, and a Parent has not assigned them) | 30 days | Automatically, every night |
| Saved Messages | Until no one has it saved any more, or a Parent deletes it, while the Household account exists. See the Saved Messages Term | Once no save remains, it is deleted the next night if older than 90 days |
| Messages a Parent deletes | Deleted at once, with every saved copy | Immediately, by the Parent in the App |
| Messages hidden (removed from view without permanent deletion) | Hidden at once; deleted at 90 days like any other, unless saved | Automatically |
| The Child's name and name recording | Until a Parent changes it, chooses "Delete all messages and recordings", or removes the Box | Immediately on any of those |
| Voice: the Child's recordings of the Box's lines | Until a Parent records over one, chooses the standard voice, withdraws the Voice consent, chooses "Delete all messages and recordings", or removes the Box | Immediately on any of those; the Box drops its copy the next time it is online |
| A Family Member's display name and name recording | Until they change it, or ask us to delete it, or their account is closed | On request, within 30 days |
| Adult sign-in account (phone number) | While the account is open | On request (section 5) |
| Household and connection records (who is in the Household, who approved whom) | While the Household account exists | When the account is closed (section 5) |
| Box records (device id, setup code, software version, last online, last error, settings) | For the life of the Box. These describe hardware. When a Box is removed, its link to the Household is cut | The last-error message is cleared when the problem is fixed |
| Downloads a Parent makes ("Download a copy") | 24 hours | Automatically |
| Text Alerts at Twilio (the recipient's number and the Child's first name) | Within 2 days of sending | Automatically, every night |
| Consent records | While the Household exists, and 3 years after its information is erased or its account is closed | Reviewed and deleted yearly |
| Erasure records (proof that "Delete all messages and recordings" ran: date and counts, no recordings) | Same as consent records | Reviewed and deleted yearly |
| Usage statistics (only if a Parent agreed: daily counts and times, keyed by Founders Unit number, no recordings or names; Privacy Policy section 4.7) | While the Household account exists | Within 30 days of a Parent withdrawing; at once by "Delete all messages and recordings"; with everything else when the account is closed |
| Purchase and distribution records (buyer, Box serial, date) | At least 6 years, for product-safety recalls | Reviewed yearly |
| Breach records | At least 24 months from the date the breach is determined | Reviewed yearly |
| Support emails and requests | 2 years after the request is closed | Reviewed yearly |
| Server logs (technical records of requests, no recordings) | Google Cloud's standard log period | Automatically by Google |
| On the Box (Wi-Fi details, a short-lived copy of the last recording, cached name recordings, cached Voice recordings, a short activity log) | Until replaced, or until the Box is removed or factory reset | A factory reset erases all of it. A removed Box erases everything but the Wi-Fi details the next time it is online |
3. Backups and recovery
3.1 When we delete a recording, our cloud storage keeps a recoverable copy for 7 days (a safety net against mistakes), then it is permanently gone. There is no other copy.
3.2 Our database has no point-in-time recovery and no scheduled backups, so a deleted Message record cannot be restored.
3.3 If we ever take a manual snapshot of the database (for example before a system change), it holds no recordings, is kept off any Box, and is deleted within 30 days.
4. Deleting sooner
4.1 A Parent can delete at any time in the App, on any Plan, including Free: single Messages (with every saved copy), or everything about the Child at once ("Delete all messages and recordings"). Both take effect immediately.
4.2 Anyone can ask the Privacy Officer to delete their information. We do it, and confirm in writing, within 30 days.
4.3 What "Delete all messages and recordings" keeps, and why: the consent and erasure records (to prove what was agreed and done); the Box's hardware record (so it keeps working); the adults' own accounts (they belong to the adults, who can ask separately); and Messages between adults that never involved the Child.
5. Closing an account
5.1 To close your Household's account, write to the Privacy Officer. We close it within 30 days of your request. Within 90 days of closing it, we delete the Household's Messages, recordings, Saved Messages, names and name recordings, and the adults' sign-in accounts, unless an adult asks to keep their own account for another Household. We keep only the records in section 2 that the law requires or that prove what was agreed.
5.2 If you want your Child's information gone at once, choose "Delete all messages and recordings" in the App before you ask us to close the account. It works immediately.
6. When a paid Plan ends
6.1 A Household whose paid Plan ends moves to the Free Plan. Nothing is deleted because of the change.
6.2 Messages already sent follow the normal 90-day deletion.
6.3 Saved Messages stay for as long as the Household account exists. The Parent can still hear, save, download and delete their own Child's Messages on the Free Plan.
7. Changes
If we shorten a period, we apply it to everything already held. If we lengthen one, we tell Parents first and it applies only to information collected after the change, unless you agree otherwise.