Data retention.

Pause vs delete

Deep sleep is a pause that moves the disk to a snapshot; nothing here changes it.

Deleting a box

Deleting a box terminates the machine and erases its disk. Before the disk goes, the last state of it is kept as a snapshot named deleted-<box>-<date>, listed under Recently deleted on Dashboard → Snapshots with the days it has left. It is kept for 7 days, then removed on its own.

• Undo a delete. Restore the snapshot. The box comes back as a new box, with the old name if nothing else took it, and its disk exactly as it was when deleted. Restoring renews the copy's 7 days, so you can restore it again.
• What it does not count against. Final snapshots do not count toward the 20 snapshots you can keep; only the ones you take yourself do.
• Remove it sooner. Delete now on the Recently deleted row removes the copy immediately. Turning on zero data retention removes every copy and stops new ones.

What a delete removes right away: the machine, its disk, its private tunnel and SSH identity, and any phone access password for it. What it keeps, in your workspace: the box's event history and its usage on your billing ledger. Those go when the workspace itself is erased; see Records retained after deletion.

Deletion operations

Every delete answers with an operation you can poll instead of watching the box or snapshot itself.

curl -X DELETE -H "Authorization: Bearer $PRIZED_TOKEN" https://prized.dev/api/v1/boxes/<box-id>
# {"box":{...},"operation":{"id":"dop_…","kind":"box_delete","status":"pending",...}}

curl -H "Authorization: Bearer $PRIZED_TOKEN" https://prized.dev/api/v1/operations/dop_…
# {"operation":{"id":"dop_…","kind":"box_delete","status":"completed","completedAt":"…"}}

DELETE /api/v1/snapshots/<id> answers the same way with kind: "snapshot_delete". Deleting something already being deleted returns the same operation. Finished operations stay readable for 30 days. From the CLI, prized ops status <id> prints an operation, and --wait polls it until it completes or fails.

Zero data retention

Dashboard → Workspace → Data and privacy, owner only, from the dashboard (no API key can switch it). Turning it on asks you to type exactly delete deleted box data, lowercase with no extra spaces; turning it off asks nothing.

With it on:

• A deleted box leaves no final snapshot, so a delete cannot be undone. The copies kept from earlier deletes are removed at once.
• The box monitor stores no process or port history for your boxes, and the history it already stored is deleted the moment you switch it on. Metrics are kept 24 hours instead of 30 days.
• Snapshots you take yourself are untouched: they are your explicit choice and stay until you delete them.

Closing a workspace

Dashboard → Workspace → Close workspace, owner only, confirmed by typing the workspace's name. It happens at once:

• The plan is canceled immediately, not at the end of the period. Credit already in the balance stays there but is not refunded; if you reopen, you pick a plan again.
• Every box is paused. Disks are kept.
• Every CLI token, install link, API key and phone access password in the workspace is revoked. Your own dashboard sign-in stays, so invoices stay readable and you can reopen.
• Other members are removed, the invite link stops working, and domain auto-join is switched off. Nobody can join, and the workspace's settings cannot be changed, until you reopen.
• You get one email naming the deletion date.

Nothing is deleted for 30 days. A banner on every dashboard page names the date, and Reopen on it clears the close: boxes stay paused until you start them (which needs a funded balance, as ever), the plan is not restored, and domain auto-join stays off until you switch it back on. Until you reopen, no new box can start, no box can wake, and no plan can be bought or changed. After 30 days the workspace is deleted for good, as described under Erase.

Erase now, below Close on the same page, skips the window. It terminates every box and its disk, deletes every snapshot, secret, environment and API key, removes the billing account from Stripe, and signs you out for good. There is no undo.

Records retained after deletion

Deleting a box or a snapshot removes the machine, the disk and the storage; the box's event history and its usage on your ledger stay in your workspace, because the workspace is still there to own them.

Erasing the workspace (by Erase now, or by the 30 days after a close running out) deletes the workspace and everything in it: boxes, disks, snapshots, secrets, environments, tokens, members, the account row, and the workspace's internal records too: its ledger, its hourly usage, its box event history and its CLI usage aggregates. After that, what remains is:

• Invoices and payment records at the payment processor. Stripe keeps the invoices, receipts, charges and refunds it issued, as required for tax and accounting. Prized keeps no copy of your ledger.
• Sign-in identity history. Which provider account (Google or GitHub) signed in as which user. It is kept to prevent re-registration abuse: a reassigned or recreated mailbox must not inherit, or re-create, a deleted account's standing.
• Fleet-level aggregate telemetry. Counts that describe the fleet as a whole (how many boxes ran, how many CLI commands of each version succeeded). They carry no per-customer identity and cannot be traced back to a workspace.

Telemetry retention windows

These windows are enforced by an hourly pass; a row may live up to an hour past its window before it goes.