My company has built a social networking app that is growing very, very quickly. We have a LOT of data. We're trying to figure out what makes sense to keep - 30 days? 90 days? This is a mostly-anonymous social network so the idea of anonymity is important. Would less than 30 days be OK? Is there a legal guideline here? (i can't find one) In the absence of legal framework, what are best practices?

I say idea of anonymity because we don't prevent you from using personally identifiable information - but you're free to make up a username (or change it later) and the app doesn't show your exact location, IP address, guid, etc.