Data Retention and Deletion Policy
Last updated: November 12, 2026
This policy describes Loopy’s current operational retention periods. A longer period may apply when required to comply with law, resolve a dispute, prevent fraud or abuse, or preserve security.
| Data | Current retention |
|---|---|
| Workspace, project, member, feedback, screenshot, and activity data | Until an authorized user deletes the item or an owner deletes the workspace. |
| Enhanced debugging recordings | Project-configured retention of 1–90 days (30 days by default). Expired recordings become inaccessible; scheduled cleanup removes stored objects. Deleting the related report, project, or workspace also queues their deletion. |
| Unsubmitted recordings | Bounded browser memory only, cleared when the page closes or recording is stopped and cleared. No cross-page persistent replay history. |
| Widget settings and team marker in a visitor’s browser | Until the visitor clears that website’s storage. The settings copy is replaced each time the widget receives new settings. See the Privacy Policy. |
| Confirmed sender email on a report | With the report: until an authorized user deletes it or an owner deletes the project or workspace. |
| One-time codes that confirm a sender’s email | Stored hashed, with the address they were sent to, and valid for 10 minutes. Deleted when used or when the same address asks for a new code; an unused code is deleted by a daily cleanup once it is a day past expiry. |
| Sender sign-in in a visitor’s browser | The token stops working after 30 days. The stored item stays until the visitor clears that website’s storage. |
| Private source maps | Until the related project or workspace is deleted. A source map is immutable for its project, release, and asset URL. |
| Pending invitations | Until accepted, declined, revoked, or the related workspace or project is deleted. |
| Billing records in Loopy: Stripe identifiers, plan status, seat count, trial and renewal dates, and who started the trial | Until the workspace is deleted. Deleting a workspace first ends its plan in Stripe. |
| The record that a person has had the free trial, which outlives a deleted workspace | Two years after the trial started, so that each person gets one free trial in that time. A daily cleanup deletes it once the two years are up. |
| Payment and invoice records at Stripe | Kept by Stripe under its own retention policy. Deleting a workspace ends its plan but keeps the Stripe customer and its invoices as the record of what was paid. |
| Authentication identity | Until separately deleted by Loopy or its authentication provider. Deleting a workspace does not delete the underlying Google or Supabase login identity. |
| Rate-limit fingerprints | Up to 24 hours after the last request in the bucket. |
| Application and security logs, and operational alerts | According to the active hosting, database, and alerting provider settings, then deleted or overwritten on their normal schedule. |
| Backups | Deleted data may remain in encrypted provider backups until those backups expire on the provider’s rolling schedule. |
How deletion works
Deleting feedback, a project, or a workspace removes its active database records and requests deletion of associated screenshot objects. Debugging objects use a durable deletion queue with scheduled retries. Storage deletion is best effort and provider caches or backups may take additional time to expire. Workspace deletion is permanent and cannot be undone through Loopy.
Exports
A workspace owner can download an export from Settings before deletion. The export contains workspace data, available debugging recordings, and screenshot bytes available at the time of the request. Known stored credentials and secrets are excluded.
Requests
Use the controls in Settings or email hello@tryloopy.co. Include enough information to identify the workspace and verify authority. Website visitors should normally contact the website where they submitted feedback; Loopy will assist that customer as needed.
For the categories of information involved, see the Privacy Policy.