Data Retention and Deleting Recordings

Recordings are personal data about your users, so AnyReplay keeps them only as long as your organisation says, and deleting one deletes it everywhere.

The retention setting

• Retention is set per organisation, in days, under Settings → Data retention. A new organisation starts at whatever its plan includes, which on Free is 14 days.
• It can be set from 1 day up to whatever the plan includes — 14 days on Free, 365 on Enterprise. The Data retention field says the number for your plan; see pricing for the rest.
• Owners and admins can change it. Shortening retention deletes data, which is why it is a permissioned setting.
• A session's age is measured from when it started.

How expiry works

A retention sweep runs every six hours. It finds sessions that started longer ago than their organisation's retention and deletes them in batches. A session therefore disappears within about six hours of passing its retention, not at the exact minute. If one recording cannot be deleted, the sweep carries on with the rest and tries that one again on the next pass.

What is deleted

Stored objects are removed before the database row. If removing the objects fails, the row stays and the deletion is retried; the opposite order could leave a recording on disk that nothing refers to.

Cached string translations

Interface text translated for your organisation is cached so the same string is not translated twice. The retention sweep deletes cached strings that have not been used for longer than the retention period. Strings a reviewer has corrected are kept until the organisation is deleted, because they act like a glossary for every later translation.

Deleting a recording yourself

Moderators, admins and owners can delete a session from the session list or the player. The recording is removed immediately in the same way, and the deletion is written to the audit log.

To erase every recording of one person — by user id, email or visitor id, across all projects — owners and admins use Privacy requests. See privacy requests.

Deleting a project

Deleting a project deletes all of its recordings and app assets from storage first, then its records.

Closing an organisation

• Only an owner can close an organisation, under Settings, by typing its name.
• Recording stops for all of its projects within about a minute.
• The data is kept for a 30-day grace period, during which an owner can cancel the closure.
• After that, everything is permanently deleted: every project's recordings and assets, sessions, translations, members and the audit log. Owners are emailed when the closure is requested and when the data is deleted.

Backups

Whichever way data is deleted — by retention, by hand, by a privacy request, or with a project or organisation — it is permanently deleted; backup copies expire within 30 days.

What is never stored

• Passwords, payment fields and anything shaped like a card number: masked in the browser in every configuration. See masking and blocking.
• Masked input values and ar-mask text: replaced before they are sent. Note that field values are recorded unless you turn masking on.
• The contents of ar-block elements and of scripts.
• On React Native, photos from the device's caches or photo library.
• The visitor's IP address. The recording endpoint uses it in memory to rate-limit itself and writes it nowhere — not to a session, not to a log.

Where a session says it came from

A session carries an approximate country and city, and with them a region and time zone. They are not derived from an address we keep: the network in front of the hosted recording endpoint (Cloudflare) resolves the address as the request passes through and sends the answer along as a request header. AnyReplay reads it from the first request of a session, stores it on the session, and never updates it — a visitor who moves between chunks does not rewrite a recording somebody has already watched. No postcode and no coordinates are read or stored.

They are deleted with the session, like the rest of its metadata, and a self-hosted deployment with no such network in front of it leaves all four empty. See self-hosting.

Usage counters

Monthly session and hour counters record what was used during the month. Deleting a session does not change them, so it does not give that allowance back.