Data Retention & Deletion Policy

MyRhythm keeps personal information only for as long as it is needed to run the platform, meet legal obligations, and keep members safe. We do not keep data "just in case".

Retention periods are set per data type, reviewed annually, and applied automatically where possible.

Videos, photo posts, descriptions and comments:

• Live content: kept until you delete it or close your account.
• Soft-deleted content (the Bin): recoverable for 90 days, then permanently erased from live systems.
• Draft uploads never published: removed after 30 days of inactivity.

Kept while your account is active. When an account is closed, profile data, contact details and settings are deleted or anonymised within 90 days, except where a longer period is required by law or an active safeguarding or legal matter.

Paused accounts retain data until reactivated or closed; pausing does not start deletion.

Records of payments — competition entry fees, booking payments and payouts, and competition hosting fees — are kept for 7 years from the transaction, as tax and company law require. After that they are anonymised: the amounts remain in our accounts, but who paid and the payment references are removed.

What you agreed to share with a competition organiser when you entered is a consent record, and is kept for the consent period below even after the payment it came with has been anonymised.

Entry records, scores and adjudication feedback are kept for the duration of the competition plus 24 months, so results can be verified and disputes resolved. After that they are anonymised or deleted.

Certificates and published results may be retained as anonymised records of achievement.

Audience votes record the voter's IP address and device identifier only to stop repeat voting. Both are removed 90 days after the competition ends; the vote itself is kept with the competition's records.

Consent records (including parental consent) are kept for the life of the account plus 24 months, so we can demonstrate which version of a document was agreed to.

Safeguarding reports and moderation records are kept for 36 months, or longer where required by law or an authority.

Security and diagnostic logs are kept for up to 12 months. Login session records are kept for up to 12 months. Analytics are aggregated or anonymised wherever possible.

Records of the emails and notifications we send, including the address each was sent to, are kept for 12 months as evidence of delivery, then deleted.

Encrypted backups exist for disaster recovery. When data is deleted from live systems, it disappears from backups as they rotate — within 30 days. Backup data is never used for any other purpose.

You can delete content yourself at any time, and request account or data deletion through the Privacy Centre or via info@myrhythm.io. Verified requests are completed within the periods above, and we confirm completion in writing.