PRV-014
Privacy policy does not say how long data is kept
MediumDefault severity · Privacy / Legal · Legal, privacy and consent
Last reviewed
What it checks
The linked privacy policy for a retention period or retention criteria.
Why it matters
GDPR (Art. 13(2)(a)) and India’s DPDP rules expect people to be told how long their data is stored. Potential compliance risk. Review recommended. This is not legal advice.
Recommended fix
Add a retention section: what you keep, for how long, and what happens after.
How to verify
Read the updated privacy policy and confirm the section is there.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue PRV-014: Privacy policy does not say how long data is kept
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Add a "How long we keep your data" section to the privacy policy: each kind of data the app stores, how long it is kept (or the rule that decides), and when it is deleted. Base it on what the code actually stores.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Read the updated privacy policy and confirm the section is there.References
Potential compliance risk only. This is not legal advice.