# Privacy and data retention

> The team privacy modes, per-space overrides, how long moatbox keeps each kind of data, and what closing your account does.

You control how much moatbox keeps about your spaces with three switches. Owners and admins set them for the whole team in **Settings > Privacy**. Some can also be set for one space.

## The three team modes

On at team level means on for every space, new spaces and forks too. Members cannot turn a team mode off for their own space. Owners and admins change the team policy in the dashboard or with an API key that has the `team.admin` action. Turning on zero data retention is the exception: it needs a browser session.

### Monitoring off

No process list and no command or process history in any space. CPU, memory, disk and I/O samples stay: usage and abuse checks need them.

The space's runtime stops recording commands and processes. Asking a space for its history or process list returns `monitoring is off for this space: no process list and no command or process history`.

### Snapshots off

No automatic history, and no new saved snapshots or share codes. When you turn it on:

- moatbox deletes every space's automatic history for good, right away
- saved snapshots stay until you delete them
- share codes you already made keep working until they expire or you revoke them
- nobody can save a new snapshot or create a share code
- deleting a space takes no final snapshot

Snapshots are covered in [Snapshots](https://docs.moatbox.dev/snapshots.md).

### Zero data retention

When you delete a space, moatbox skips the trash and erases the space's snapshots, share codes and records, except the ones listed under **It keeps**. Sleep that keeps memory still works.

To turn it on you need a signed-in browser session and you type `erase space data`. No API key can turn it on. Before you confirm, the dashboard counts what it will delete now.

It deletes:

- every saved, automatic and final snapshot of the team's spaces, now
- every share code, now
- spaces in the trash, now; later deletes skip the trash
- after a space is deleted: its metrics, alerts, webhook deliveries, CI job output, run list, approval notices and resets

It keeps:

- billing records: usage, invoices, wallet
- the audit log, with who did what and when
- API key usage counts
- AI usage: requests, tokens and cost per day and model, no prompts
- webhook delivery records for 30 days, or until the space is deleted: event ids, types and small data, never command text or output
- undo points from resets and restores, on the space's server, until they expire or you delete the space
- each deleted space's database row, and its CI job records without their output

It still allows:

- sleep that keeps memory: the state stays on the space's own server
- command output and history: kept inside the space only, never stored by moatbox

Under zero data retention, moatbox saves no CI runner log when a job ends, and run traces carry no command text.

## Per-space settings

A space can turn on more than the team does. It cannot turn off what the team policy keeps on; the API answers `your team's policy keeps this on`.

| Setting | Where | Who |
| --- | --- | --- |
| Snapshots off | The space's **Snapshots** page, **Privacy** card | Owners and admins |
| Zero data retention | The space's **Snapshots** page, **Privacy** card | Owners and admins |
| Command and process history | The space's **Monitor** page | Any team member |

For one space, snapshots off deletes its automatic history. Zero data retention deletes every snapshot of that space, saved ones too, and revokes its share codes. Deleting the space then skips the trash. Zero data retention for a space also needs a browser session and the typed phrase `erase space data`.

**Settings > Privacy** lists the spaces that set more on their own.

```bash
curl -X PUT https://app.moatbox.dev/api/v1/spaces/my-space/privacy \
  -H "Authorization: Bearer $MOATBOX_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"snapshots_off": true}'
```

## How long moatbox keeps what

The tables below follow what moatbox does. `GET https://app.moatbox.dev/api/v1/retention` returns moatbox's own retention list without sign-in, and **Settings > Privacy** shows that list. Some of its rows describe the data differently from these tables.

### Inside the space

| Data | Kept |
| --- | --- |
| Commands run in a space, with their output | 30 days, in the space only. Run traces (below) can hold the commands agents ran. |
| Finished processes: command, user, CPU and memory, no output | 72 hours from the process start, and at most the newest 20,000 |
| Output kept per command stream | Up to 256 KiB per stream, from the start; the rest is dropped. All commands share 10 MiB of kept output per hour. |
| Output of a finished API command, for fetching | 10 minutes after it ends, up to 8 MiB per stream |

### On the space's server

| Data | Kept |
| --- | --- |
| Automatic snapshots | Solo 7 days, Pro 14 days, Team 30 days |
| Saved snapshots | No expiry. Solo keeps 5, Pro 20, Team 50. |
| Deleted spaces, restorable | 72 hours, then purged with their snapshots. Zero data retention skips the trash. |
| Share codes | 7 days by default, 30 days at most |
| Undo points from resets and restores: the disk from before | Solo 30 days, Pro 90 days, Team 365 days |

### In moatbox's database

| Data | Kept |
| --- | --- |
| CPU, memory, disk and I/O samples | 7 days |
| Alerts and space events | 90 days |
| Run traces for OpenTelemetry export | 90 days. Erased with their event. Without command text under zero data retention. |
| Webhook deliveries, with payloads and attempts | 30 days. Payloads hold ids, types and small data, never command text or output. |
| Browser sign-ins | 30 days, renewed on use, 90 days at most |
| Audit log | While the team exists, also under zero data retention |
| AI usage: requests, tokens and cost per day, space and model | While the team exists. Prompts and answers are never stored. |
| API key request counts per day | While the team exists, also after the key is revoked |

## Close your account

Go to **Settings > Privacy**, press **Close account…** and type your account's email to confirm.

### What happens now

For each team you are alone in, moatbox:

- closes the team, stops its spaces and moves them to the trash
- cancels the plan
- revokes the team's API keys and pending invites, and turns off automatic top-up

For each team you share with other people, you leave it. The audit log records that you closed your account.

For you, moatbox signs you out everywhere, deletes your SSH keys and push subscriptions, revokes your API keys and the invites you sent, and disables the account. You get an email with the date of final deletion. To change your mind before then, reply to that email.

### After 30 days

moatbox deletes each closed team's spaces and their snapshots, then the team itself with its audit log. Then it deletes your user record. If it cannot delete the record, it erases your email, name, avatar and sign-in links from it. The spaces of a closed team stay in the trash for those 30 days instead of the usual 72 hours.

### The only-owner rule

If you are the only owner of a team that other people still use, moatbox refuses to close your account:

```text
you are the only owner of <team>, which other people still use: make one of them an owner, or remove them, first
```

Make another member an owner, or remove the other members, and try again. Roles are covered in [Teams](https://docs.moatbox.dev/teams.md).

Closing needs a signed-in browser session. No API key can do it.

## API

All routes live under `https://app.moatbox.dev/api/v1`.

| Method and path | Does | Needs |
| --- | --- | --- |
| `GET /retention` | The retention list that **Settings > Privacy** shows | Nothing |
| `GET /teams/{team}/privacy` | Team modes, per-space overrides, and what zero data retention would delete now | Any member; key action `team.read` |
| `PUT /teams/{team}/privacy` | Set `monitoring_off`, `snapshots_off`, `zero_retention` | Owner or admin; key action `team.admin`; turning on `zero_retention` needs a browser session and `"confirm": "erase space data"` |
| `PUT /spaces/{space}/privacy` | Set `snapshots_off`, `zero_retention` for one space | Owner or admin; key action `space.update`; same rule for `zero_retention` |
| `PATCH /spaces/{space}/monitoring` | `{"enabled": false}` stops command and process history for one space | Any member; key action `space.update` |
| `POST /me/close` | Close your account. Body: `{"email": "<your email>"}` | Browser session |