Data and privacy

This page describes what the code running at relstore.stackwell.tech does with data today. Where something is missing, it says “Not yet”.

What relstore stores

Your data. For each table, its definition and every version of every row: the rid, the version number, when it was written, whether it is a tombstone, the values of every column, and the client id and role that wrote it. relstore does not look inside your values; whatever you write, including personal data, is stored as you sent it.

About your database. Its id, when it was created, the ids of its two ChirpAuth clients, and, if one was given when it was set up, the ChirpAuth id of the person who owns it.

Logs. Operational logs are kept for 30 days. When a request fails, the log line names the error and the table and column involved, never the values in your request or your rows.

relstore runs on AWS in the us-east-1 region (United States), in a Postgres database that is encrypted at rest. The service connects to it only over TLS.

How long

relstore deletes nothing on a schedule. Every version, tombstones included, is kept for as long as the database exists. The database is backed up automatically, and backups are kept for 7 days.

Who sees what

• Your database’s agent and operator clients can read every current row and every row’s history through the API.
• No other client can read your database through the API; Postgres refuses it (see Concepts).
• Stackwell, which runs the service, can access the database directly.

What deleting does

A soft delete (POST /v1/rows/{rid}/soft-delete) hides a row from queries. It removes nothing: every version stays in the row’s history and in the database.

Not yet:

• Nothing can be permanently removed. Removing a row, a table or a whole database, or erasing every row of a database, needs a person’s approval, and that step is not enabled on the live service: purge requests and erasures answer 503. Until it is, everything written to relstore stays. Once it is, what is removed is gone from the live database at once and from its backups within 7 days.
• Deleting a client in ChirpAuth does not touch relstore. The database and everything in it stay.