Data Retention Policy — Hummingbird (DepEd Abra · DRRM deployment)
DRAFT for review against DepEd records-disposition schedules and the Division's archives policy. Matches system behavior as of 2026-07-12.
Principles
Damage assessments, validations, and approvals are official government records: the system is designed to keep them, keep their history, and keep who did what. Deletion in the product is therefore *soft or scoped by design* — the exceptions below are explicit.
Schedule
| Data | Retention | Mechanism / notes |
|---|---|---|
| Damage reports (all statuses incl. superseded) | Retained indefinitely as official records | Approved figures frozen; corrections supersede rather than overwrite; superseded rows remain in history |
| Discarded drafts | Soft-deleted, retained | deleted_at set; excluded from all views/totals; kept for audit reconstruction |
Audit trail (activity_logs) | Retained indefinitely | The accountability record; cleared only by explicit Division decision (SQL-level, documented in HANDOFF) |
| Photos / documents | Life of the record they evidence | Private storage bucket; served only via short-lived signed URLs to authorized roles |
| No-incident reports, preparedness, registries (schools/buildings/equipment) | Current + historical, retained | Registry edits are audited; no version snapshots beyond the audit trail |
| Staff account data (profile) | Until account deletion | Deletion removes sign-in + profile; the person's name remains on records and audit entries they authored (attribution is part of the official record) |
| Notifications | Operational; prunable | In-app rows; no official-record status |
| Push subscriptions | Until unsubscribed or invalidated | Endpoint keys only |
| Offline device queue | Until synced or duplicate-dropped | Lives only on the composing device; see docs/offline/OFFLINE_DATA_POLICY.md |
Backups (JSON dumps scripts/backup-affected-tables.ts) | Owner-managed; recommend 90 days rolling + permanent quarterly | Stored outside the app; upgrade path is Supabase PITR (retention per plan) |
| Server/application logs (Vercel) | Platform default (short) | Not an official record; contains no report content by policy |
Disposal
Official-record disposal (if ever mandated by a records-disposition schedule) is a Division decision executed at the database level with a documented order — the application intentionally provides no bulk-erase button for approved records or audit history.