# Data handling

What Page Systems stores, how long it keeps it, who can see it, and what it does not collect. Read this before you decide what to put on a page.

## What we store

- **Page content:** the spec your agent sends (title, description, branding and the page type's data).
- **Answers:** for an input page, the answer the person submits.
- Both are stored in our database in a form the service can read. Page Systems needs to read them to validate the spec, render the page and its link preview, and return the answer to you. Pages are **not end-to-end encrypted**, so Page Systems can read what you put on a page and what the person sends back.
- Callbacks carry only the page ID, not the answer. Your integration reads the answer with its API key (see [Callbacks](/docs/api#callbacks)).

## Encryption

- Pages, the REST API and the MCP server are served over HTTPS.
- Our database provider, Neon, requires TLS for database connections, and its documentation states that it encrypts stored data at rest. We have not yet verified that configuration for our own Neon project.
- There is no end-to-end or customer-key encryption. Encryption of answers with a key only your integration holds is a possible future option, not a current feature.

## How long we keep it

- **The rule:** a page's content and its answer are deleted when the page expires. Read the answer before then: once it is deleted, Page Systems cannot recover it. Page lifetimes are listed under [Limits](/docs/api#limits).
- **How it works:** from the moment a page expires, its link and the API stop returning its content and answer. A cleanup job that runs every minute then deletes them from the database, normally within a minute of expiry. One exception: an answer accepted just before expiry is kept until its callback has been attempted once (at most about 10 seconds), so your integration is told about it first. The callback URL and `agentRef` are deleted 24 hours after expiry. A record that the page existed (its id, page type, status and times) is kept for usage and billing.
- Deleting a database row does not instantly remove every copy: database backups and restore history keep data for a limited period after deletion.

## Who can see a page

- Anyone with a page's link can open it. The link is long and unguessable, but it does not check who is opening it, and a forwarded link works for whoever receives it.
- Once the person answers, the page closes: anyone who opens the link sees only "Thank you." (and your return link, if you set one), never the page content or the answer. The same holds after expiry or cancelling.
- Answers are read through the API with your account's API keys; another account's page reads as not found.

## Copies outside Page Systems

- **Link previews:** chat apps such as iMessage and Slack fetch the page title, description and preview image when the link is sent, and may keep their own copy. Expiry and deletion cannot remove it. Our own servers cache a preview image for at most a minute.
- **The person:** whoever opens the page can screenshot it, copy it or save it. Expiry cannot recall content that was already downloaded.
- **Your systems:** answers you read through the API are in your own storage, under your own retention rules.

## What not to collect

Page Systems does not collect highly sensitive data: payment card details, passwords or other credentials, or identity-document numbers. A general form is not a way around this. Validation enforces part of it:

- A [General form](/docs/pages/form) field whose id, label, placeholder or help text asks for one of these is refused with `400 invalid_spec`. The check looks for specific phrases such as "card number", "CVV", "password", "PIN", "one-time code", "passport number", "driver's licence" and "social security".
- Ordinary fields that only sound similar are allowed: "Name as shown on passport", "Loyalty card number", "Order ID number", "PIN code" (a postal code), and yes/no or select fields such as "I will pay by card on arrival".
- An answer whose free text contains a payment card number (13 to 19 digits with a card network's prefix that pass the Luhn check) is refused, in form text fields and itinerary change notes. The person sees: "This looks like a payment card number. Card details can't be collected here; remove it."
- The check does not scan the content you put on a page. Keep sensitive data out of titles, descriptions and other page data too.

For example, a form with a `Card number` field is refused with:

```text
✖ This field appears to ask for payment card details. Page Systems does not collect payment card details, passwords or other credentials, or identity-document numbers. Remove the field or ask for something else (see /docs/data-handling).
  → at page.fields[0].label
```