Data retention and deletion

What it is for

This page answers questions from your privacy notice, your data protection officer (DPO) or a security questionnaire.

For how many of your users come back, see Retention.

How long Sequential keeps data

Data	How long Sequential keeps it
Events (for example page views, clicks and custom events), with the full IP address, and the user, session and account records Sequential builds from them	The organisation's events retention period, counted from when each event arrived. See The events retention period
Identity links: the link between a visitor and the value you passed to identify()	No expiry
Session recordings, as something you can play	The organisation's replay period, counted from when the first part of the recording arrived at Sequential. The default is 30 days
Session recordings, as stored files, with the DevTools data recorded with them	The replay period, and about 2 days more. Then the storage deletes them automatically
Heatmap data: counts of where sampled visitors click and scroll, an hourly pointer to one recording of each page, and from 11 October 2026 the session ids of rage clicks on each element. See Heatmap data	Shown for the replay period. Stored up to about a week more: Sequential deletes it one week at a time
A heatmap page picture, made from one recording. Sequential's hosted service makes these pictures with its builder service. See The page picture	At most 15 minutes, and never longer than its recording

• The audit log keeps each team member's IP address and browser with no expiry. Only deleting the organisation removes it. The exception is the entry for a deleted project: see Delete a project.
• Sequential does not store a copy of the payload that your SDK sent. It stores the event that it builds from it.

The events retention period

Each organisation has an events retention period. It applies to all the projects of the organisation, also to the projects that you add later. It is one of 7, 30, 90, 180 or 365 days. The default is 365 days.

Only Sequential support can change it. Sequential support can set a period with an end date. After the end date, the default applies again. Your audit log records each change as organization.limits_changed. See Audit log. For a longer period, write to support@usesequential.com.

To see the period that applies, open Settings → Projects → your project → Session replay. A line under the summary shows it, for example "Events kept · Set by Sequential: 7 days". What SDKs receive shows it as events_retention_days.

From 14 October 2026, a project has no retention period of its own. A period that was saved for a project before that date stays in its settings, but it does not apply. Owners and admins cannot change the period through the settings API: see A retention change through the API below.

• The period counts from when the event arrived at Sequential. It does not count from the time in the event.
• Sequential deletes events one week at a time, once a day. So Sequential keeps each event for at least the period, and for up to about a week longer.
• The user, session and account records use the same period. Sequential deletes them by whole weeks, so a record can stay up to about a week longer than the events that it was built from. When a session's events are deleted, the session goes from Sessions.

The replay period

Each organisation has a replay period, next to its events retention period. It applies to all the projects of the organisation. It is one of 7, 30, 90, 180 or 365 days. The default is 30 days.

Only Sequential support can change it, also with an end date, as for the events period. To see the period that applies, open Settings → Projects → your project → Session replay. The summary line shows it, for example "7 d", and a line under it says "Replays kept · Set by Sequential: 7 days". What SDKs receive shows it as replay_retention_days.

• The period counts from when each part of a recording arrived at Sequential. Sequential puts the parts of a recording that arrive in the same 5-minute period together, and counts from the start of that 5-minute period.
• When the period of the first part of a recording ends, the whole recording expires. You cannot play any part of it anywhere in Sequential. If the period became shorter during the recording, a later part can stop playing earlier.
• About 2 days after the period ends, the storage deletes the recording files, with the DevTools data in them.
• Heatmap data follows the replay period too. Sequential deletes it one week at a time, so it can stay stored up to about a week longer. It is never shown after the period: the Heatmaps page and the API stop showing a day's data when that day's recordings stop being viewable. A shorter period deletes no stored heatmap data.

A server-wide limit

A Sequential server can set one retention limit for every project on it. The limit is 7, 30, 90, 180 or 365 days. A server without a limit changes nothing on this page. Sequential's hosted service, the preview, has a limit of 7 days. There, every organisation keeps events and recordings for 7 days, data stays 7 to 14 days, and the storage deletes recording files 9 days after they are written. Sequential support can exempt the events of an organisation's projects from the limit: see below.

When the server has a limit:

• The shorter period applies. For events, recordings and heatmap data, the period that applies is the shorter of the organisation's period and the limit. If the limit is lifted, the organisation's period applies to data that arrives after that. Data that was already deleted does not come back.
• The settings API shows the limit. The answer shows the period that applies under effective and org_retention, and a clamps entry with reason deployment_cap.
• Data goes in weekly blocks. Sequential deletes data one week at a time. So with a limit of 7 days, data stays 7 to 14 days, and up to about 1 day more until the daily deletion runs. Data stored before the limit was set goes on the same schedule. This includes heatmap data and its hourly pointers to recordings.
• Recording files go sooner. The storage deletes each recording file 2 days after the shorter of the replay period and the limit, counted from when the file was written. This includes files written before the limit was set.
• More data is deleted. With the default schedule, once it is older than the limit plus 8 days, Sequential also deletes runtime issues (the errors and failed requests that findings are built from), judgments, 👍/👎 feedback, identity links and Ask searches. It also deletes each finding that was last seen before then, with its verdicts, links, verification results and hand-off records.
• Usage counts stay. The usage counts, the record of each AI call, release markers, the fix brief delivery log, the agent call log and the audit log keep the periods in the tables above.

A self-hosted server sets the limit with RETENTION_MAX_DAYS: 7, 30, 90, 180 or 365, or unset for no limit. It sets the default period of every organisation with ORG_RETENTION_DEFAULT_DAYS, one value for both events and recordings: 7, 30, 90, 180 or 365. Unset, the defaults are 365 days for events and 30 days for recordings. Any other value of either setting stops the server from starting.

Organisations that Sequential support exempts

Sequential support can exempt an organisation from the limit, for example the organisation of a demo project. The exemption applies to all its projects, also to the projects that you add later. Only Sequential support can set or remove an exemption. While the limit is shorter than 365 days, Sequential support cannot remove an exemption, because the removal would delete the data that the exemption keeps. For the projects of an exempt organisation:

• Events keep the organisation's period. Events, and the user, session and account records built from them, stay for the organisation's events retention period.
• Other data is kept for up to about 373 days. Judgments, 👍/👎 feedback, identity links, Ask searches and findings do not go at the limit. With the default schedule, Sequential deletes them when they are older than 365 days plus 8 days, or earlier if their own period in the tables above is shorter.
• Recordings stay under the limit. Recordings, heatmap data and runtime issues still go at the limit.
• Settings show the longer events period. For example: "Events kept · Set by Sequential: 365 days".
• The audit log records each change as organization.retention_cap_exempt_changed, by "Sequential support". Entries from before 13 October 2026 show project.retention_cap_exempt_changed. See Audit log.

Archive or delete a project

Owners and admins can archive or delete a project.

	Archive	Delete
Ingest keys	Refused until you restore	Removed
Recording	Off	Off, because the keys are gone
The project in the app	Hidden from the project switcher, so you cannot browse its data	Gone from the organisation, with its recording settings and rubric
Events, and the user, session and account records	Kept. They come back when you restore, except data whose period ended while the project was archived	Unavailable at once. Permanently deleted within 14 days with the default schedule
Judgments, feedback, Ask searches, identity links, release markers and the other stored data	Kept	Unavailable at once. Permanently deleted with the events
Usage counts: events, sessions and recordings per day, and a record of each AI call	Kept	Kept. They hold no user, session or event identifiers
Recording files	Kept	Unreadable at once, because Sequential deletes their encryption keys. The storage deletes the files later. After you delete a project, the app shows the date by which they are removed
Undo	Restore project	None

To stop collecting and keep the history, archive the project. Do not delete it. To stop only recordings, turn off Recording.

Archive a project

1. Go to Settings → Projects → your project → Danger.
2. Under Archive, select Archive project.
3. Select Archive.

While the project is archived, Sequential refuses all data that your app sends. Sequential does not store it for later. Archiving does not pause any period.

Delete a project

When you delete a project, Sequential records a deletion for the data it stores about the project: events and the records built from them, judgments, feedback, Ask searches, identity links, release markers, runtime issues, the fix brief delivery log, heatmap data and the index of its recordings.

• With the default schedule, Sequential permanently deletes them within 14 days: the deletion job runs once a week, and Sequential allows one more week in case a run fails. After you delete the project, the app shows the exact date.
• If their retention period ends first, they go at that time.
• Sequential marks the deletion done only when none of the rows are left in storage.
• For up to about a minute after you delete a project, a page that is still open can deliver heatmap data. Sequential deletes it with the rest of the project's data.
• The audit log entry for the deletion stays. After 90 days, Sequential removes the project name, the IP address and the browser from it.

Sequential keeps the project's usage counts after the deletion. These are the number of events for each day and source, the number of sessions for each day, the number of recorded sessions for each day, the number and size of the stored recording parts for each day, and a record of each AI call: its time, feature, model and token counts, also added up for each day. From 11 October 2026, they also include the storage size of the project's recordings for each day, and of its other tables that are kept for each project, such as judgments and identity links. The size of its events is not counted for each project. They keep the project's id, but no user, session or event identifiers and no text.

Sequential deletes the encryption keys of the project's recordings at once. So the recordings become unreadable at once, and no page in Sequential serves them. Every Sequential server refuses the keys within 60 seconds of the delete, even if Sequential cannot tell its other servers. A part of a recording that a server is already reading can finish. The storage deletes the recording files later, about 2 days after the end of their replay period. After you delete the project, the app shows the date by which the files are removed. This date is Sequential's own upper limit, not a promise from the storage provider. The storage usually removes the files before that date. If Sequential found no recordings for the project, the app shows no date for them. A backup of Sequential's key store can keep a copy of the keys until that backup expires.

A heatmap page picture is encrypted with the same keys, so it also becomes unreadable at once. Sequential also removes the stored pictures and the waiting picture requests of the project.

Delete an organisation

Deleting an organisation deletes each of its projects, and Sequential records the same deletion for each one as for a project delete. You do not need to delete the projects first. The recordings of each project become unreadable at once, as when you delete a project. The app does not show a date for the recording files.

Deleting an organisation also deletes its audit log. Copy what you need from the Audit log first.

Before Sequential deletes the organisation, it reads the ingest keys of its projects, so that it can stop them on every server after the delete. If Sequential cannot read them, it refuses the delete and changes nothing. The page then shows "The organisation was not deleted: it could not be prepared. Try again."

Then Sequential writes its own record of the deletion. If Sequential cannot write this record, it refuses the delete and changes nothing. The page then shows "The organisation was not deleted: its deletion could not be recorded. Try again."

Sequential also writes a record of the organisation's id. If the organisation started a test checkout in the past, the record also holds the payment provider's ids. If Sequential cannot write this record, it refuses the delete and changes nothing. The page then shows "The organisation was not deleted: its billing could not be closed. Try again." See Payments.

What is not possible yet

• No per-person deletion. If someone asks you to delete their data, Sequential cannot delete one person's data for you today.
• No immediate deletion of recording files. After you delete a project or an organisation, its recordings are unreadable at once. But the storage deletes the files only about 2 days after the end of their replay period.
• No partial deletion. To delete judgments, feedback, Ask searches or identity links, you must delete the project or the organisation.
• No data export. You cannot download the data of a project or a person.

Base your privacy notice and your answers to data requests on the tables above.

Before you describe this to your users

• Quote your organisation's events retention period for events. If your server sets a shorter limit, quote the limit. Say that Sequential can keep an event for up to about a week longer than that.
• Say that identity links have no expiry, unless your server sets a limit.
• Send only what you are prepared to keep. You cannot remove property values or the value you pass to identify() from a project that you keep. See Identify your users.

Limits

• Sequential deletes events one week at a time. An event can stay for up to about a week after its retention period.
• After you archive or delete a project, delete an organisation or revoke a key, every Sequential server stops accepting the keys at once. If Sequential cannot tell its other servers, for example because Redis is down, another server can accept data sent with the keys for up to a minute.
• After you restore a project, every server accepts its keys again at once. If Sequential cannot tell its other servers, another server can refuse the keys for up to 10 seconds, and can keep recording off for up to 30 seconds.
• Revoking a key does not remove the data already sent with it.
• After you delete a project, every Sequential server forgets its recordings' keys at once. If Sequential cannot tell its other servers, for example because Redis is down, another server still refuses the keys within 60 seconds. A part of a recording that a server is already reading can finish. No page serves the recordings after the delete.
• A server removes a recording key from its memory about 11 minutes after it last used the key.
• If a server cannot check a recording key, for example because its database is down, it refuses the key. The player then shows "The recording could not be read right now. Retry shortly." Select Retry. Sequential deletes nothing because of this.
• Files of recordings already past their period can stay in storage for about 2 days.
• Stricter masking or a turned-off capture applies only to new recordings. Stored recordings stay as they were recorded.
• The fix brief delivery log can miss deliveries. A missing row does not prove that Sequential delivered no brief.

Related

• Privacy at a glance
• Organisations and projects
• Roles and permissions
• Recording settings
• Masking and redaction
• Audit log