"Will my customer records disappear?" is a fair question, and it deserves one clear answer. Yaplet does delete some things on its own, every night, without asking. This page lists all of it: what goes, how long it waits, and what it never touches.
Conversations and their attachments
A conversation is deleted once it has been inactive for the full retention period — no new messages, no agent activity. The clock runs from the last thing that happened in it, not from when it started, so a long-running thread is safe as long as somebody keeps using it.
- Paid plans — three years of inactivity.
- Free plan — 120 days of inactivity.
Files and images sent in a deleted conversation are removed from storage at the same time. No organisation is exempt from this, and each night's cleanup is written to the audit log.
One consequence worth planning for: if you cancel a paid subscription, your account moves to the free plan, and with it to the 120-day tier. Conversations that were comfortably inside a three-year window can start expiring. Export anything you need to keep before you cancel.
Empty chat records
Every time a new visitor opens your site, the widget creates a placeholder conversation for them. Most of these never receive a single message — the visitor simply never typed anything. Those empty placeholders are deleted after 60 days of that visitor's inactivity. Nothing was ever written in them, so nothing is lost; it only stops your numbers being padded with conversations that never happened.
Idle anonymous visitors
An anonymous visitor with no conversations left is deleted after 125 days of inactivity. That combination matters: the visitor has to be both idle and empty, so this only reaches people who never talked to you, or whose conversations already expired under the rule above.
A visitor is kept indefinitely, no matter how long they have been idle, if any of these is true:
- They identified themselves — an email address, a phone number, or your own customer ID passed in through
identify(). - They carry a security review status or a risk signal.
- They own a session replay.
- They are banned.
In other words, the people you actually know something about stay. What gets cleared out is anonymous traffic.
Website analytics
Page views, sessions and the other analytic events behind your reports are kept for roughly 120 days. The Reports date picker will not let you pick a start date older than that, and if the range you choose has no comparable earlier period, the percentage comparisons disappear with a short note explaining why. Conversation-related events are not part of this — they live and die with their conversation.
What is never deleted automatically
- Tickets. None of these cleanups touches a ticket on any of your boards. A ticket outlives the visitor who filed it; it simply stops pointing at them.
- Newsletter send history. There is no pruning schedule for it.
- Audit log entries. They are kept for the life of the account, which is what makes them usable as evidence.
- Identified visitors, as described above.
What this means for a GDPR request
Two practical consequences. First, a subject access request about somebody who last visited a long time ago can honestly come back empty, and that is a legitimate answer — see Export visitor data for a GDPR subject access request. Second, automatic deletion is not a substitute for erasure on demand: it happens on a schedule you cannot bring forward, and it produces no record naming the person who asked. When somebody exercises their right to be forgotten, run a real erasure — see Erase a visitor's data.