Privacy

What's stored about attendees, for how long, and what to know about health data.

What's stored

From calendars: when they're busy. No titles, attendees or descriptions.
About attendees: only what you send. A booking needs just a time_zone: without a name or email, an attendee simply isn't emailed. Contact details and answers are encrypted, and a uid of your own lets you find and erase someone.
In logs and webhooks: ids, times and statuses. Request bodies of bookings aren't logged.

How long

Data	Kept	Details
Emails	45 days	Subject, bodies, addresses, headers, tags, recipient statuses, delivery events, opens, clicks and attachment names. Queued and scheduled emails are kept until they are sent or canceled, and a broadcast's emails until the broadcast is finished.
Attachment content	Until the email is sent	The bytes of attachments; only their name, type, size and checksum stay with the email.
Email content without content storage	Until the email is sent	In environments whose content storage is set to discard: the subject, bodies, headers, template variables and attachment names. The rest of the email (addresses, tags, recipient statuses, events) is kept like any other.
Received emails	30 days	Emails sent to your receiving addresses: the raw message, headers, bodies, attachments and spam and authentication verdicts. You can also delete one right away.
SMS messages	45 days	Text, phone numbers, tags, segment counts and delivery events. Queued and scheduled messages are kept until they are sent or canceled.
Received SMS	30 days	Replies and other messages sent to your phone numbers: the text and the sender's number.
Verifications	30 days	One-time code requests: the phone number or email address, the channel, the status, attempts and why one was blocked. Codes are never stored, only a keyed hash until they expire.
DMARC reports	90 days	Aggregate reports mailbox providers send about your domains: the reporting organization, source IP addresses, message counts and authentication results. The report emails themselves are not kept.
Idempotency keys	24 hours	A request repeated with the same Idempotency-Key replays the first response.
Webhook deliveries	30 days	Event payloads, delivery statuses and attempt logs (including response excerpts). Deliveries still being retried are kept until they finish.
CLI webhook listeners	24 hours after expiry	Listeners `coss listen` opens to receive the environment's events, and the forwarding status (local status code, duration, error) the CLI reports for each event. The events themselves are kept as webhook deliveries.
Hooks messages	30 days	Messages you send to your applications (payloads), their deliveries and attempt logs (including response excerpts). Deleting an application stops access to its messages at once; they are deleted with the rest of their day.
Hooks portal sessions	24 hours after expiry	Sign-ins to the portal you create for your applications' users (never the token itself).
Log drain batches	7 days	The lines sent to your log drains and their delivery attempts (including response excerpts). Lines that could not be sent within 3 days are dropped.
Content screening results	90 days	Verdicts of the automated abuse screening. The screened content itself is never stored.
Reputation statistics	31 days	Hourly bounce, complaint and Hooks delivery failure counts behind your account standing.
Dedicated IP statistics	31 days	Hourly delivery counts per sending IP of your dedicated IPs.
Standing notification emails	90 days	Records of the emails sent to owners and admins about a warning or suspension.
DMARC notification emails	90 days	Records of the emails sent to owners and admins when a domain is ready for a stricter DMARC policy, or its mail fails DMARC.
Account standing history	2 years	Warnings, suspensions and reinstatements. The latest change is kept while the organization exists.
Risk assessments	1 year	Decisions, scores, reasons, signals (ASN, country, counts) and the feedback you sent. Your user id stays until you ask coss.com to forget the user.
Risk assessment personal data	90 days	The email address, IP address and user agent you sent with an assessment. Only keyed hashes remain afterwards.
Risk memory	1 year	Keyed hashes of mailboxes that have an account and of identifiers you reported as fraud or abuse (IP addresses count for 30 days), and the countries and networks each user logged in from (by keyed hash of your user id), counted from when they were last seen.
Admin audit log	2 years	Actions coss.com staff take on organizations and users.
Expired sessions and invitations	7 days after expiry	Sign-in sessions (with the iOS app's push notification registration), verification and reset tokens, and invitations that were never accepted.
Invoices and payments	10 years	Invoices with their line items, payments and credit notes, as tax law requires. Kept after your account is closed.
Usage records	400 days	Hourly counts of billable usage per environment, and which project, API key and member (for personal keys) each came from. Each invoice keeps its month's totals.
Billing notification emails	90 days	Records of usage alerts and payment reminders sent to your billing contacts.
Notification emails	90 days	Records of the emails sent to owners and admins about what to do next, such as registering an SMS sender and the outcome of its review.
Push notifications	30 days	Records of the notifications sent to the iOS app: their kind, subject and how many devices received them, never their text.
Payment provider events	30 days	Notifications from our payment processor about invoices and payments.
Suppressions	Until you delete it	Email addresses and phone numbers that sends skip, including SMS opt-outs. Never removed automatically, so a bounced address or an opted-out number stays protected.
Inboxes	Until you delete it	Inboxes with their addresses and names, and their threads' subjects and participants. Each message of a thread goes with its email (sent or received, as above), and a thread goes a day after its last message did.
Contacts	Until you delete it	Your contacts with their custom properties, audience memberships, topic choices and consent timestamps (when they subscribed, unsubscribed or confirmed). Kept until you delete them.
Unconfirmed contacts	30 days	Contacts asked to confirm their subscription (double opt-in) who never did, deleted with their memberships and choices. One who had opted out (unsubscribed before, or left a topic) is kept, unsubscribed.
Broadcasts	Until you delete it	Broadcasts with their content and their counters (recipients, deliveries, bounces, complaints, opens, clicks, unsubscribes). Kept until you delete them; each email they made is kept like any other email once the broadcast is finished.
Signing and builder sessions	7 days after expiry	Links to the signing page and the template builder you create (never the token itself), and the ones emailed to signers.
Signature requests	Until you delete it	Documents uploaded for signing, and signature requests with their signers, the fields they filled and their audit trail (with the addresses and browsers they signed from). Kept until you delete them: they are your records of what was signed.
Form submissions	90 days	What was submitted to your forms, with uploaded files, the submitter's address, browser and the page it came from. Submissions you delete, and files of submissions you delete, are removed right away.
Spam and unconfirmed form submissions	14 days	Form submissions flagged as spam or held for review that you didn't release, and submissions whose submitter never confirmed their email address.
Booking attendee details	90 days after the booking ends	The attendee's name, email address and phone number, their answers to booking questions and the booking's metadata. You can also erase an attendee right away.
Bookings	395 days after the booking ends	A booking's time, host, event type, status and history, without its attendee's details. Calendars contribute only busy times, which are replaced as calendars change and deleted when a calendar is disconnected.
Imports from other providers	90 days	Reports of imports from Resend, SendGrid or Postmark: what was found, what was imported and what needs attention. The provider's API key is deleted as soon as an import finishes or is canceled, and an import that is never started is deleted after 24 hours. What it imported is kept like anything you create yourself.
Account and configuration	While your account exists	Users, organizations, projects, environments, API keys, domains, SMS phone numbers and carrier registrations (with the business details they were registered with), email templates (with every published version), webhook endpoints, log drains, Hooks applications, event types and endpoints, risk allow and block lists, forms, scheduling hosts, schedules, event types and connected calendars, contact properties, audiences, segments, topics, settings, and billing details (plan, contracts and credits). Items you delete (a key, a domain, a template, an endpoint, a drain, an application) are removed right away.

Erase someone sooner with their uid:

await ...("patient_77");

Coss.com isn't a system of record. If you must keep a booking's details for longer, such as a clinical record, keep them in your own systems.

Our Terms don't allow protected health information without a written agreement, and we don't yet offer a Business Associate Agreement. A doctor, a patient and a time can be health data on their own, so please talk to us before using Scheduling for patients.

Scheduling is built so it can hold that data safely, and you can reduce what it holds today: use opaque uids rather than names, avoid sensitive questions and metadata, turn off emails you'd rather send yourself, and choose neutral event type titles, since a title like "Oncology follow-up" appears in emails.

On This Page

What's stored How long Health data