Legal Deadlines and Deleting Data — Explained Simply
7 October 2026. Two questions, answered in plain words:
- What are the legal deadlines, and how does Thnkrr meet them?
- Why can't we simply keep all data forever?
This is our reading of the laws, checked against the official texts. Our lawyer should confirm it before anything is published.
Part 1: Legal deadlines
What a "legal deadline" means
When someone complains about something on Thnkrr, for example a fake profile pretending to be them, the law says how fast we must act. If we're late, we can lose the legal protection that keeps a platform from being blamed for what its users post, and we can be fined.
Which laws, and when they apply
| Law | What it is | Applies to us |
|---|---|---|
| TAKE IT DOWN Act (US) | A 2025 US law: intimate images shared without consent must come down fast | Now |
| US child-abuse reporting law | Platforms must report child sexual abuse material to NCMEC, the US centre that receives these reports | Now |
| India's IT Rules | India's rules for online platforms: complaint deadlines, court orders, intimate images | Once we have Indian users. We've built to them already, because they're the strictest and we'll need them later |
The deadlines, and what Thnkrr does for each
| Situation | How it reaches us | Deadline | What Thnkrr does |
|---|---|---|---|
| Any complaint | The public complaint form (linked on every page) | Acknowledge within 24 hours | The complaint appears on the review list with a countdown. The person who complained sees the exact times we must answer by |
| Reported unlawful content (abuse, hate, sexual content and so on) | The complaint form, or the "Report" button on any post | Deal with it within 36 hours | Shown with a countdown on the review list; turns red when late |
| An intimate image of someone, shared without consent | The dedicated removal form (no login needed) | 2 hours (the US law allows 48; India's rule is 2, so we use 2 for everyone) | The team is emailed at once. The request goes to the top of the list. A safety case opens automatically, because on Thnkrr this could be a child. Once removed, every copy disappears within minutes, and the same picture can't be uploaded again |
| Someone pretending to be someone else, or a fake or edited picture of them | The complaint form ("someone is pretending to be me") or the Report button | 2 hours | Team emailed at once; top of the list; countdown |
| A court order or government notice | Arrives by email or the government's portal | 3 hours from when it reached us | A reviewer logs it in the "Orders & notices" tab, with the time it arrived. Team emailed; countdown; recorded as done when the content is off |
| Every other complaint | The complaint form | Resolve within 7 days | Countdown on the list |
Our own deadlines, stricter than the law
| Situation | Our deadline | Why |
|---|---|---|
| A possible child-abuse case | Confirm within 4 hours, report to NCMEC within 24 hours | The law says "as soon as reasonably possible"; we set firm numbers |
| A student who may be at risk of self-harm, referred to their school | The school acknowledges within 24 hours, or 1 hour if urgent | So a counsellor actually reaches the student |
How it works day to day
- Something arrives through a form, a report or an email order.
- For anything on a 2- or 3-hour deadline, the team inbox is emailed immediately.
- It appears on the shared review list, sorted so the most urgent and the late items are at the top, with a countdown.
- A reviewer acts: removes the content, declines with a reason, or records the order as done.
- The person who complained sees the decision and our note on their status page.
- Everything is recorded in "Who did what": which reviewer, what they did, and when.
- If the time runs out, the item shows red as "overdue", and it's flagged on the dashboard.
Example: a parent reports an intimate photo of their child
- The parent fills in the removal form. No account is needed.
- Within seconds: the team is emailed, the request is at the top of the list with a 2-hour countdown, and a child-safety case opens.
- A reviewer finds the photo and removes it. Every copy is taken off within minutes, and that picture is blocked from being uploaded again.
- A locked copy is kept as evidence. Only the safety team can open it, and no reviewer can delete it.
- Vidhi, our Child Safety Lead, confirms the case within 4 hours. If it's child abuse, she reports it to NCMEC within 24 hours, and to the Indian police too if an Indian child is involved.
- The parent sees "removed" on their status page.
How the deadlines are enforced today
Here is exactly what Thnkrr has now to make sure a deadline isn't missed:
| What's built | What it does |
|---|---|
| A clock on every item | The moment a complaint, report or order arrives, its deadline is worked out and saved |
| One email to the team inbox | Sent at once for the three urgent kinds: intimate images, impersonation, and court or government orders. Only one email, and only once someone sets the team inbox address |
| Countdowns on the review screen | Every item shows how long is left, and turns red with "OVERDUE" when time runs out |
| Late items jump to the top | The review list puts anything past its deadline first |
| A "Deadlines" summary line | Counts how many of each kind are open, and how many are late |
| The complainant sees the deadline | Their status page shows the exact time we must answer by |
| A record of who did what, and when | Every action is logged with the reviewer's name and the time |
What's missing. Today the system only works if someone is looking at the screen:
- No second reminder. If the first email is missed, nothing else happens.
- No phone call or text. Email only, to one inbox.
- No one on call at night or at weekends. A 2-hour deadline at 2am has nobody to act on it.
- No moving up the chain. If nobody picks something up, nobody more senior is told.
- No report of how we did. We can't yet say how many deadlines we met or missed.
- Intimate images stay visible until a reviewer acts on the request.
How LinkedIn and other companies do it
No company publishes its internal tools for this. What they do publish:
| What they do | Example |
|---|---|
| People working around the clock | X says it has a team working 24 hours a day, 7 days a week, in every language it supports |
| A dedicated team for each kind of request | X has a team just for India's complaints. Meta sends court and government orders to its lawyers first |
| A named, published person in charge | LinkedIn names its India Grievance Officer, with an address and a web form. Its Indian court orders go to a separate email inbox at its law firm |
| Clear routes to escalate | LinkedIn's reviewers can pass hard cases up to policy managers, who can ask the lawyers |
| The riskiest items first | Meta sorts its review list by how serious an item is, how fast it's spreading, and how likely it is to break the rules |
| Shared lists of known images | Facebook, Instagram, Snap, TikTok, YouTube and others use NCMEC's "Take It Down" list, so a reported image is blocked everywhere |
| Publishing their speed | LinkedIn says it decides a member's report in about 21 minutes (the middle figure) and confirms a government request in under an hour |
What happens if a platform misses a deadline:
| Where | What happens |
|---|---|
| India | The platform loses its legal protection and can be held responsible for what users post. In 2021 the government said Twitter had lost it |
| US, intimate images (TAKE IT DOWN Act) | Fines of up to $53,088 for each missed request. The US regulator (the FTC) began enforcing in May 2026 and has already written to platforms |
| US, child-abuse reports | Knowingly failing to report: fines of up to $600,000 the first time, and $850,000 after that |
The big companies meet these deadlines with many people working around the clock and a clear chain of who does what. At our size, the same idea is one person on call who gets a phone call, and calls that move up the chain if nobody picks up.
What we recommend
Each item is marked US law now, India law later (once we have Indian users), or good practice.
-
Someone is always on call. (Good practice, but the only way to meet a 2-hour deadline at night.)
- Reviewers cover the day, roughly 7am to 11pm.
- One reviewer is on call overnight and at weekends, taking turns week by week (one week in five each).
- Vidhi, the Child Safety Lead, is always the second person called.
-
A phone call or text for urgent items, not just email. (Good practice.) Intimate images, impersonation and government orders ring the on-call person's phone.
-
Reminders that move up the chain. (Good practice.) For a 2-hour item:
Time since it arrived What happens 0 minutes The on-call reviewer is called 30 minutes, nobody has picked it up Called again 60 minutes Vidhi is called 90 minutes The engineering lead or founder is called For 3-hour orders, the same steps, spread out. For 24- and 36-hour items, a reminder at halfway and another 4 hours before the deadline.
-
Hide first, check after, for intimate images. (Good practice.) When a properly filled-in removal request arrives, the image is hidden straight away, then a reviewer confirms it. If the request turns out to be false, the reviewer puts it back. Nobody waits for a person to wake up.
-
Named people, published. (India law later, good practice now.)
- The Grievance Officer's name and contact details on the site.
- One named person responsible for all the deadlines.
- A separate inbox for court and government orders that rings the on-call person.
-
Join NCMEC's "Take It Down" list. (Good practice.) An image reported anywhere is blocked on Thnkrr too.
-
A tracking number and full times for every request. (US law now.)
- Every request gets a tracking number. We already give one.
- We record when it arrived, when it was acknowledged and when it was acted on. Mostly built.
- The "who did what" record can't be edited.
-
Check how we're doing. (Good practice now, India law later.)
- Every week, 15 minutes: how many deadlines we met or missed, and how fast we were.
- Within 48 hours of any missed deadline: a short note on what went wrong and the fix.
- Monthly: a summary in the same layout big platforms publish in India, so we're ready if it's ever required.
What this needs:
- From us: the phone or text alerts, the escalation steps, hide-first, the weekly numbers and the monthly summary. About 2–3 days of work. Not built yet; waiting for your go-ahead.
- From the founder: agreement to an on-call rota, and the named people.
- A small paid service to make the calls and texts, typically a few dollars a month.
Also still needed
- The Community Guidelines page, which publishes these deadlines. The founder sends the text, or we draft it.
- India's Grievance Officer: a named person on the site, required by law before we have Indian users.
Part 2: Deleting data
The short answer
"Never delete" is not the standard, and for a platform for teenagers it isn't allowed in the long run:
- LinkedIn deletes a closed account's data within 30 days. It keeps only what the law requires.
- Facebook and Instagram delete within 90 days, keeping only what's needed for legal reasons or safety.
- Some laws make us keep certain records for 180 days or a year.
- Other laws, and the school contracts, make us delete at set moments.
So the real standard is keep while the account is in use, delete when there's a reason to, and keep only what the law requires after that.
What the law says we must KEEP
| What | How long | Which law | Applies to us |
|---|---|---|---|
| Anything reported to NCMEC (child abuse) | 1 year after the report | US child-abuse reporting law | Now |
| Content we removed | 180 days | India's IT Rules | With Indian users |
| Sign-up details of a closed account | 180 days after it closes | India's IT Rules | With Indian users |
| System logs | 180 days, kept within India's reach | CERT-In, India's cyber-security agency | With Indian users |
| Personal data and activity logs | At least 1 year, even if the person deletes their account | India's data protection law (DPDP) | From 13 May 2027 |
| Anything linked to a lawsuit or police investigation | Until it's over | General legal duty | Now |
What the law says we must DELETE, or can't keep forever
| What | When | Which law | Applies to us |
|---|---|---|---|
| A person's data, once it's no longer needed, or once consent is withdrawn | At that point, unless another law requires keeping it | India's data protection law (DPDP) | From 13 May 2027 (the government has proposed bringing it forward to November 2026, so check) |
| A person's data, when they ask | On request, unless a law requires keeping it | India's data protection law | From 13 May 2027 |
| A school's student data, when the school asks or its contract ends | Within 60 days | The standard US school data agreement (NDPA), which most US districts use | As soon as a school signs it |
| A student's data, when the school asks | When asked | California's student privacy law (SOPIPA) | Now, for California schools (our lawyer to confirm) |
| Data of children under 13 | Only as long as needed; never forever; with a written policy | The US children's privacy law (COPPA) | Only if an under-13 slips through. We don't allow them, so we delete at once |
| Data unused for 3 years | With a 48-hour warning | India's data protection rules | Not us: only platforms with 20 million+ Indian users |
What Thnkrr does today
- Content we remove is hidden, not deleted. It's kept, locked, for the legal periods above.
- Anything linked to a child-safety case is kept at least a year, and can't be deleted by a reviewer.
- Messages are kept, with no end date set. That's the open question below.
- Sign-ups whose parent never says yes are deleted after 30 days, unless they're linked to a safety case.
- "Who viewed your profile" records are deleted after 90 days, as on LinkedIn.
- There is no "delete my account" yet. It's needed before Indian users, and before any school asks.
What we recommend
- Keep everything while an account is in use.
- When an account is closed: hide it within 24 hours and delete it within 30 days, as LinkedIn does. Move only what the law requires into a locked store (removed content and sign-up details for 180 days, logs for a year, anything under a legal hold), and delete that automatically when the time is up.
- When a parent never gives consent, or withdraws it: delete after a short grace period.
- When a school asks, or its contract ends: offer students a copy of their own posts first, then delete that school's student data within 60 days and confirm it in writing.
- Accounts unused for a long time: pick one period, for example 3 years, with a warning first.
- Legal holds always win. Nothing under a child-safety case, police request or lawsuit is ever deleted until the hold ends.
- Write it all down as one "data retention schedule". Schools will ask for it, and the law requires one if we ever hold under-13 data.
Decisions needed (founder, with our lawyer)
- How long do we keep messages? Today there's no end date. This is the biggest open point.
- The inactivity period (point 5 above).
- Approve building "delete my account" and the steps above. They're needed before Indian users, or before the first school contract ends.
- Confirm the India start date with our lawyer: 13 May 2027, or earlier if the government brings it forward.
Sources: the US TAKE IT DOWN Act and the FTC's 2026 guidance and enforcement notice; LinkedIn's EU transparency report (August 2025) and India Grievance Officer page; Meta's and X's India monthly reports and Meta's content-review page; NCMEC's Take It Down participant list; the UK regulator Ofcom's code of practice (February 2025); 18 U.S.C. §2258A (US child-abuse reporting); India's IT Rules 2021 as amended in February 2026; CERT-In Directions 2022; India's DPDP Act 2023 and DPDP Rules 2025; the US COPPA Rule (16 CFR §312.10, as amended 2025); FERPA (34 CFR §99.31) and US Department of Education guidance; California's SOPIPA; the NDPA v2 school data agreement; LinkedIn's privacy policy; Facebook's Help Center. All checked 6–7 October 2026.