Erasure and retention.
What Notify keeps, for how long, and what happens when a user asks to be forgotten.
1
Erase a recipient
DELETE /recipients/{external_id} (notify.recipient.delete) answers 202 and, in short batches, deletes the profile, devices, preferences and their history, inbox items and anything not yet sent. Past deliveries keep their ids and states for your statistics but lose the address and the rendered text; a notification sent only to this person loses its data and actor. Then a recipient.deleted webhook fires and the workspace audit log records it.
// 202: profile, devices, preferences, inbox and pending deliveries are
// deleted; past deliveries keep their ids and states without the address or
// rendered text. A recipient.deleted webhook follows.
const erasure = await notify.recipients.delete("user_123");
console.log(erasure.status);2
What ProductCraft Mail keeps
Emails Notify sent went through Mail, and Mail’s message log keeps the address under Mail’s own retention. Erasing a recipient in Notify does not remove those messages: delete them in Mail (per message), and if the address is on Mail’s suppression list, decide whether it should stay there (a suppression is how a complaint is honoured).
3
Linked Auth users and workspaces
- A recipient linked to a ProductCraft Auth end user (
auth_user_id) is erased when that end user is deleted. For 24 hours the id cannot be recreated by a send or a token mint (recipient_erased), so an in-flight job cannot bring it back. - Deleting the workspace deletes every Notify record of it, keys included.
4
Retention
| Record | Kept for |
|---|---|
| Notifications, deliveries and attempts (including the rendered push text) | 30 days |
| Inbox items | 90 days, or 30 days after the recipient archives them |
| Devices | until pruned (removed 7 days later), or after 270 days without a registration |
| Daily statistics | 13 months |
| Recipients, preferences and preference history | until you erase the recipient or delete the workspace |
| Push credentials | until you delete or replace them; a replaced key’s ciphertext is wiped after 24 hours |
Push credentials and private keys are stored encrypted and are never returned by any API or the console. Notify is hosted in the EU (Frankfurt).