Privacy Requests: Erasing One Person's Recordings

When someone asks you to delete what was recorded about them, an owner or admin can erase every matching recording from the dashboard in a few clicks. This page covers finding the person, what an erasure removes, and the two larger deletions: an AnyReplay account and a whole organisation.

Finding a person's recordings

• By user id. In Sessions, the User ID filter matches the userId you passed to identify exactly. The id appears in the visitor column and in the player's Details tab.
• By email. The search box in Sessions matches the email you passed to identify, as well as page URLs.
• By visitor id. For visitors who were never identified, the player's Details tab shows the visitor id AnyReplay assigned. On the web, the recorder keeps it in the visitor's localStorage under anyreplay.vid, so a person can read it from their own browser if you ask them to.

Erasing recordings

1. Open Privacy requests

   In the dashboard sidebar, open Privacy requests. Owners and admins see it; other roles do not.

2. Describe the person

   Enter a user id, an email address, a visitor id, or several. A recording is erased only when it matches every identifier you enter, so adding one narrows the request. The email is compared without regard to case; the user id and visitor id must match exactly.

3. Choose the projects

   Leave All projects selected, or pick one project to limit the request to it.

4. Check the count

   Find recordings counts the matching sessions before anything is deleted. If nothing matches, nothing can be submitted — check the spelling or use fewer identifiers.

5. Confirm

   The request is queued and a background job deletes the recordings in batches, usually within a minute. The table below the form shows its progress and, when it finishes, how many sessions were deleted.

If some sessions could not be deleted, the request is marked failed with the number that remain. Submit the same request again: it matches whatever is still there and deletes it.

What an erasure deletes

Deleted data is permanently deleted; backup copies expire within 30 days.

What is kept afterwards

Once the job has run, the identifiers from the request are kept only as SHA-256 hashes. That lets your organisation show later that a given person's request was carried out — hash their identifier and compare — without keeping a readable list of the people who asked to be forgotten. The list in the dashboard shows which kinds of identifier were used, who made the request, and the counts. The audit log records that an erasure was requested and completed.

Recordings made after the request

An erasure removes what exists when it runs. Recordings made later under the same identifiers are not affected. If the person asked not to be recorded at all, stop identifying or recording them as well — for example by waiting for consent and not granting it for them.

Through the API

The dashboard uses these endpoints, and they take the same signed-in session. Each needs the owner or admin role.

{
  "identifiedUserId": "u_42",
  "identifiedEmail": "[email protected]",
  "projectId": "optional — omit for every project"
}

Give at least one of identifiedUserId, identifiedEmail and visitorId. The identifiers are never returned by these endpoints; a request lists only which kinds it was given.

Deleting an AnyReplay account

This is about your own dashboard login, not about your visitors. Under Account → Delete account:

• You confirm with your current password. Accounts without a password (Google sign-in) or with two-step sign-in confirm with a code sent by email; a two-step account that has a password gives both.
• It is refused while you are the only owner of an organisation that has other members. Transfer ownership, or close the organisation, first.
• Organisations where you are the only member are deleted together with the account; the dialog lists them.
• Your memberships and sign-in sessions end. Audit log entries you made stay, with the actor shown as "Deleted user". A confirmation email is sent.

Closing an organisation

An owner can close the whole organisation under Settings → Close organisation, by typing its name.

• Recording stops for all of its projects within about a minute.
• The data is kept for a 30-day grace period, during which an owner can cancel the closure from Settings.
• After that, everything is permanently deleted: every project's recordings and assets, sessions, translations, members and the audit log. Backup copies expire within 30 days.
• Owners get an email when the closure is requested and when the data is deleted.