Gear Handoff — Data Retention Policy
Effective date: November 3, 2026 Last updated: November 3, 2026
This policy describes how long Free The Oppressed Studios LLC retains data in Gear Handoff (gearhandoff.app) and how it is deleted.
0. Data Protection
Data is encrypted in transit (TLS) and at rest by our infrastructure providers. In addition, each organization has its own data encryption key, wrapped by AWS Key Management Service (KMS), so our database does not hold a usable key. The following are encrypted with the organization's key when created: condition, handoff, and reservation notes; incident descriptions, locations, and resolution notes; status report notes; photo waiver reasons; GPS coordinates on condition photos; free-text fields in internal event and notification records; and condition photo files and billing-proof files, which are encrypted before upload. Asset serial numbers are also encrypted, with a keyed (HMAC) blind index so exact-match lookups still work. Some data stays readable so we can run the service: organization ID and name, memberships, member email addresses, timestamps, Stripe identifiers, asset tags, and organization logos. Organization logos are stored in a public storage bucket and are publicly accessible. Within the app, access to an organization's data is restricted to its authorized members, who must use multi-factor authentication. Integration credentials (Slack and webhook secrets) are additionally encrypted at the application layer, under a separate application key rather than the per-organization keys. The running service, and a small number of authorized FTO personnel, can decrypt data when needed to operate, secure, support, and bill the service; that access is limited and logged, and decryption of billing-proof files is recorded in our admin access log. Access to the AWS KMS keys is limited to FTO's owner and the app's narrowly scoped service credential. The service decrypts content automatically to send digests and, if an organization connects Slack, to post to Slack. Slack receives decrypted notes and photo links, and Slack's own terms and privacy policy govern that content once it is delivered.
1. Active Orgs
Customer Data (members, gear, handoff records) is retained for as long as the Org has an active trial or paid subscription, unless deleted earlier by the Org.
2. Unpaid Orgs and Trial Expiry
| Stage | When | Access | Data | |
|---|---|---|---|---|
| Payment declined | Day 0 (first failed payment) | Full access; Owner emailed right away | Retained | |
| Cure period | 3 days (72 hours) from first failed payment | Full access; Owner can update card and pay | Retained | |
| Not paid within 72 hours | Hour 72 | Org locked: members can't use the app; Owner can reach only billing and data export | Retained | |
| Deletion warning | Day 23 (7 days before deletion) | Locked | Retained; warning email sent | |
| Never paid | Day 30 after first failed payment | No access | Deleted; encryption key destroyed |
- A successful payment at any point before deletion unlocks the Org immediately, and all data carries over.
- After deletion, data cannot be recovered. Unpaid Orgs do not get the read-only hold; that hold applies only to voluntary cancellation (Section 3).
- Trial expiry. A 7-day free trial (no card, one per Owner account) does not auto-convert. Reminder emails are sent 3 days and 1 day before the trial ends, and when it expires. An expired trial does not lock. It becomes read-only (members can view but not change anything) for 30 days from the expiry date; subscribing during that time restores full access with all data. If not subscribed, the Org is purged at day 30 and its encryption key is destroyed. A warning email is sent 7 days before deletion. The 72-hour lockout applies only to a failed payment on a paid subscription.
- All of these emails come from no-reply@gearhandoff.app, which is not monitored. Support is through in-app help tickets or support@fto-studios.com (see Section 9).
3. Cancellation (paid Orgs)
On cancellation, the Org stays fully active until the end of the paid period. It then enters a 30-day read-only hold: members can view data but can't edit. Resubscribing on the website during the hold restores full access, and all data carries over. If the Org isn't restored, it is purged at day 30. No refunds are issued. Cancellation never deletes data immediately. Only an Owner's Org deletion (Section 4) takes effect immediately.
4. Org Deletion by an Owner
When an Owner deletes an Org, access ends and the Org's data and wrapped data key are removed from our live systems immediately. This includes Org data relating to all members. It cannot be undone. Stored files (such as photos) are deleted from file storage separately. Residual copies in restricted database backups expire as described in Section 6, and we keep only the records listed in Section 7. Deleting an individual account is different (Section 5). If the Org is on a paid plan, its Stripe subscription is canceled right away with no refund.
5. Individual Members
Account deletion. A user can delete their own account in the app (Account, then Delete my account, confirmed with a recent authenticator code and by re-typing their email; a confirmation email is sent), or email support@fto-studios.com if they can't sign in or are locked out. Deletion is completed within 30 days. The user's login and account information are deleted. The Org may retain limited custody and history records, with that person shown as "Deleted user"; this label does not by itself make the records anonymous, and identifiable records remain subject to applicable privacy rights. Billing, security, and legal-hold records are kept as described in Section 7. A sole Owner must transfer ownership or delete the Org first. Account deletion does not delete an Org whose ownership has been transferred, or cancel the new Owner's subscription.
Member removal. When an Owner removes a member from an Org, the member's access to that Org ends. Their account is not deleted, and they keep access to any other Org they belong to. The Org's history records relating to that member are kept as Org data.
6. Backups
Our infrastructure provider (Supabase) keeps daily backups of the database for disaster recovery only. Backups are not a customer undo feature. Database backups are kept for 7 days. They include file metadata but not stored file objects (such as photos and billing-proof files); stored files are deleted from file storage separately when their Org or record is deleted. If data is ever restored from a backup, we reapply prior deletions before returning it to ordinary use. Data that is deleted or purged from the live Service, whether by the 30-day purge, by non-payment deletion, or by an Owner's deletion, may remain in database backups for up to 7 days after deletion and then ages out. Restores from backup cover the entire Service and are not offered for individual Orgs. For canceled Orgs, the 30-day read-only hold is the customer recovery window; for unpaid Orgs, paying before deletion at day 30 restores access; and an Owner's Org deletion is final.
Each Org's wrapped data key is destroyed immediately when an Owner deletes the Org, when a canceled Org is purged at the end of the 30-day read-only hold, when an expired trial Org is purged 30 days after trial expiry, and when an unpaid Org is deleted 30 days after its first failed payment. The key is kept until then so the Org can be restored. Once the key is destroyed, data encrypted with it (the notes, incident and status text, GPS coordinates, photo waiver reasons, sensitive event fields, condition photos, billing-proof files, and serial numbers listed in Section 0) is designed to become unrecoverable once the database backups that contain the wrapped key expire, within 7 days. Destroying the key means deleting the Org's wrapped data key; it does not involve deleting the AWS KMS master key. Other Org data in those backups ages out on the same schedule.
7. Data We Keep After Deletion
Even after purge or deletion, we may retain:
- Billing and tax records (held by us and by Stripe) for 7 years after the end of the tax year they relate to;
- Security logs for 180 days;
- Privacy-request records for 24 months;
- Automatic-renewal consent records for 3 years, or 1 year after the subscription ends, whichever is longer;
- Discount-verification records (entity name, decision, proof source and date, and discount dates) for as long as the billing records they support. Proof documents are deleted immediately after verification;
- Records needed to comply with law, resolve disputes, or enforce agreements;
- Aggregated or de-identified data that no longer identifies individuals or Orgs.
Usage and activity data: raw per-person daily-activity records and security-email send logs (notice type, success or failure, and time only; no content or recipients) are kept for 90 days, then reduced to daily aggregate totals with no person or organization identifier. The single last-active timestamp per user is overwritten as the user is active and kept until the account is deleted. Person-level activity data is deleted when the user's account is deleted. When an Org is deleted or purged, it is deleted for members who have no remaining membership in another Org. Like other deleted data, it may remain in disaster-recovery backups for up to 7 days.
Owner export during holds. During the canceled Org's 30-day read-only hold, the expired trial's 30-day read-only period, and the unpaid period before deletion at day 30 (including while locked), the Owner can export the Org's data.
8. Legal Holds
We may suspend deletion of specific records where required by law, valid legal process, or a litigation hold. Holds are applied narrowly to the records concerned.
9. Contact
Free The Oppressed Studios LLC (FTO Studios) 10205 US Highway 15 501 Unit 26-289 Southern Pines, NC 28387
Legal and privacy: Legal@fto-studios.com Support: in-app help tickets (preferred) or support@fto-studios.com
Emails from no-reply@gearhandoff.app are not monitored.