# WYG Data Retention Schedule — Pilot Draft

**Status:** School selection and operational verification required  
**Updated:** August 23, 2026

This schedule applies only after it is attached to a signed School agreement. The School selects the instructional-record window in WYG. Until an automated retention job is independently validated, WYG must apply and document scheduled deletion through a controlled manual process.

| Record category | Examples | Proposed active retention | Deletion trigger and target |
|---|---|---|---|
| Program and roster | Program settings, display/roster name, username, role, position, optional jersey/email | Contract term | Delete within 30 calendar days after verified School instruction or contract end, after export if requested |
| Credentials and active sessions | Password-derived credential, session token hash, invitation/recovery token hash | While account/token is valid | Revoke immediately on deactivation; delete with account/program; expired tokens removed during scheduled cleanup |
| Playbook and private source files | Plays, routes, assignments, uploaded PDF/image/CSV/JSON | Contract term | Delete or return within 30 calendar days after no longer needed or termination |
| Test definitions and versions | Test settings and immutable play snapshots | School-selected instructional window | Delete with the program unless a shorter written instruction applies |
| Attempts and answers | Drawings, choices, scores, timestamps, version evidence | School selects 90, 180, 365, 730, or 2,555 days | Scheduled deletion after selected age or verified School request, subject to School record duties |
| Drawing adjudication | Athlete note, coach decision and timestamp | Same as related attempt | Delete with related attempt/program |
| Team messages | Coach notices to team/position group | Contract term or School-selected shorter period | Delete with program or on verified instruction |
| Audit and security events | Administrative actions, failed access, privacy-request evidence | Proposed 12 months after event | Delete after period unless needed for active incident, dispute, or legal duty |
| Support records | Reporter contact, request details, resolution | Proposed 12 months after closure | Delete or de-identify after period unless contract/law requires longer |
| Incident evidence | Security facts, containment actions, affected records | Duration of response plus legally advised period | Restrict access; delete after closure and legal/insurance requirements expire |
| Deletion certificate | Program ID, request authority, scope, completion date | Proposed 7 years, no student content | Delete after contract/legal retention period |

## School-selected default

Selected attempt/answer window: [90 / 180 / 365 / 730 / 2,555 DAYS]. The School should choose the shortest period consistent with its educational and records obligations.

## Exceptions

A documented legal hold, active security incident, payment dispute, or mandatory recordkeeping duty may pause deletion only for the affected records. WYG will isolate and restrict the held records, tell the School unless prohibited, document the basis, and delete when the exception ends.

## Verification

For each deletion batch, WYG records the authorizing request, affected program, record categories, responsible operator, start/completion time, exceptions, and verification query. WYG provides a written certificate that identifies what was deleted and any remaining lawful exception. Backup/replica deletion timing must be confirmed with the hosting providers before the pilot and inserted here: [BACKUP EXPIRATION PERIOD].