Monday Storage Persistence After Uninstalling the App

Hello there @0xm3t1,

The data is not wiped when the app is uninstalled.

If the account re-installs the app, the data will be there.

Cheers,
Matias

How long is the data retained? As app developers we are required to delete data within 10 days per monday requirements for marketplace listing, which means we technically cannot comply with monday’s own rules if we use monday code.

Hello there @anon29275264,

It is handled case-by-case and by users’ demand.

Cheers,
Matias

Just to be clear if using monday code, monday is assuming responsibility for the data stored in the storage API, and its retention according to local laws?

Correct @anon29275264, monday is assuming responsibility for the data stored in the storage API, and its retention according to local laws 😁

Cheers,
Matias

Hello Matias,

The app review process requires that the app clear its data upon reinstallation. However, my app currently shows stored data even after being reinstalled. I find this behavior to be contradictory to the stated requirements. Could you please help me understand how to implement this? I don’t see a way to clear data upon uninstalling.
Also, isn’t it a requirement to keep data for 30 days even after uninstalling the app?

I can’t think of anything worse than the app wiping data on uninstall. If the user decides to uninstall/reinstall, very bad things will happen that they may not be aware of until the accidentally destroy all their data. 
 

monday should automatically perform a cleanup of orphaned app data after a number of days — sometime between 10 and 30 days. 
 

———

Aside For ​@lashibandara: ​@Matias.Monday isnt working on this community any more. 

​@dvdsmpsn I 100% agree. But the review process is asking me to implement it somehow. And I have no idea how to do it at the moment. My app is a pure front end app. Apparently it’s a new requirement. 

Hi ​@lashibandara, I’m going through the review process and have the same issue - a pure frontend app with simple config stored in the global storage. Now, how am I supposed to automatically delete the data on uninstall? Would you share how did you resolve it?

I agree with ​@dvdsmpsn - if app uses monday storage and the stored data becomes monday’s responsibility, then the data auto-delete in X days (not immediately, unless it’s on user request) should be easily handled also by monday.

Hi ​@mtkacz-soldevelo .

Actually, according to the documentation, we don’t have to do that if we use monday storage. But to be honest, they didn’t seem to understand that  and sometimes it felt like they had no idea what they were doing.

If we use a separate storage method, we still have 10 days (if I remember correctly) to remove customers’ data. So, I asked them to wait until I cleared the data using the CLI, and the reviewer was kind enough to agree.

She asked me whether I was ready before testing, and as soon as I received the uninstall notification, I cleared the storage for the account the reviewer was using. So by the time the reviewer reinstalled the app, the data was already gone.

To receive that uninstall notification, you need to either configure the App Lifecycle webhooks or install the App Lifecycle Management app from the marketplace.

​@lashibandara Thank you for your response. Your insights are very helpful. I hope it will also be enough in my case. I will add an update in the near future.

I’m leaving my promised update. Maybe it will help some people in a similar situation in the future.

So to sum up, our reviewed app:

• is frontend only, deployed to monday CDN.
• uses monday global storage to store very simple config per each board view.
• doesn’t store any additional user data outside the monday ecosystem.

After some discussion in turned out that having the config stored per each board view (meaning that if you add a new board view, you get - let’s call it - “fresh app start experience”) is enough to be accepted. In the end I didn’t have to delete any data for the review purposes.

I also dug through the documentation and found at least those two bits:

#1 https://developer.monday.com/apps/docs/privacy-and-security

#2 https://developer.monday.com/apps/docs/shield-badge#frequently-asked-questions

So to my understanding, data removal requirement isn’t relevant if you use frontend-only apps with monday storage. Anyway, this whole process is confusing.

Oh, and I also wrote to support. They confirmed, what we already suspected and knew: for frontend-only apps using monday global storage, there is currently no automated way to trigger data removal from storage upon app uninstall. The official method provided is the manual CLI command. Of course having webhooks and CLI commands we (vendors) could setup some external service to listen to app lifecycle events and run the command programmatically, but for me it clashes with the idea of having and running everything on monday side.

Finally, I also recommend to set up the App Lifecycle Management app. It’s useful to track lifecycle events, so you know which accounts should have their storage removed (the 10 days period after uninstall).

If it helps others about to go into review, I was directed during review process of my board view app to set up a webhook handler to perform this uninstallation, even though my app also falls into that “frontend only, hosted on monday client side CDN, uses monday storage” category. Even so, the webhook auth format monday.com sends is not entirely compatible with GCP cloud function endpoints, so it didn’t work anyway.

We (the reviewer and myself) settled on agreeing to a manual deletion process using the monday apps CLI by running `mapps storage:remove-data --appId=<my app id> --clientAccountId=<client account id>` from the lifecycle management app notification I get. App ended up being approved, fwiw. However, it sounds like this is not a strict requirement! How confusing.

two observations to validate others’ observations:
1. I also agree that immediately removing a user’s stored data is poor UX, especially if they need to reinstall the app for whatever reason.
2. The disconnect between the docs, requirements, policies and review process is frustrating and confusing.