Data retention

Every service keeps something. Typical categories are the account itself, billing records that the law may require, logs that help to find faults, usage counters that apply limits, backups and analytics. Each can have its own period: web-server logs are often rotated within weeks, invoices are kept for years because accounting law asks for it, and analytics shrink to aggregate totals. The useful habit is to look at them one by one rather than accept a single promise such as we keep nothing. Data protection law in Europe states the same idea as storage limitation: personal data should not be kept longer than needed for its purpose.

For AI services, one case matters above the others: the request itself. Zero retention means the provider that runs the model processes your text to produce the reply and does not store it afterward. It is a commitment by the provider, and a chain of providers each makes its own. Some makers keep requests for a period under their own policy, for instance to monitor abuse, and that period is theirs to set, not the app's. Abstract words like private say little until the duration and the holder are named.

Backups complicate matters: a record erased from a live database can survive in an archive until that archive expires. Deleting is also more than a button. Ask what is deleted when you delete a conversation or an account, whether it happens at once or on a schedule, and whether a trace stays, such as a record of a deletion that other devices need to learn about. Short retention reduces what a breach, a subpoena or a curious employee can reach, though some regimes force longer keeping, such as tax records, and a good policy says so rather than hiding behind a vague phrase. A clear policy names what is kept, why, for how long, who can reach it and what disappears when you leave.

The transparency page lists what NeverNo's servers keep, line by line. Your account (email address, sign-up date and last sign-in) lasts as long as the account exists. A share link lasts until the expiry you chose, 1, 7 or 30 days, or until you delete it, then it is erased within the hour. Your encrypted backup stays until you delete or replace it. Service-health counters, which hold no account, no id and no message, are kept 30 days; provider-spend amounts, 35 days; raw product statistics, 90 days, after which only anonymous daily totals remain. A deleted item in encrypted sync leaves a trace without content for 180 days, so your other devices delete it too.

The text of your messages is not on that list: it crosses our servers while the reply is made and is written nowhere. At the model, it depends on the label. Private models are open models served by DeepInfra or by OpenRouter with its zero-retention option. DeepSeek V4 Flash, free on NeverNo, is one of them, with a context of 128,000 tokens and replies up to 8,192 tokens. For anonymized models, the maker reads the text and may keep it for a while under its own policy.