1. Scope
This supplement replaces only the statements about expiry and deletion of optional analytics and Session Replay records in our Privacy Policy version 2026-10-17-umami-identified-v2 and in the earlier optional analytics and Session Replay notices, which said that these records had no automatic expiry or deletion schedule. The current identified analytics supplement continues to describe the account, organisation and plan information collected after your choice. This retention update does not change what is collected, who can see it, why we use it or your choices. Your analytics and Session Replay choices stay as they are, and this update does not ask you to make a new one. The linked Privacy Policy continues to provide our controller details, other processing information, rights and contact route.
2. How long we keep optional analytics records
Session Replay recordings are deleted once they are more than 90 days old, counted from the last part of the recording. Chunks stored together for the same native visit are deleted only once the newest chunk is more than 90 days old; current recordings are capped at five minutes. Analytics events, meaning selected page views and product events together with their event properties, are deleted 25 months after they were collected. Each period is counted from the time the individual record was collected.
Account and organisation details that you allowed us to attach to analytics sessions are stored with those sessions. We delete a session and its stored properties only when the session is more than 25 months old and no analytics event from the last 25 months or Session Replay recording from the last 90 days remains for it. A replay-only session can therefore retain its stored properties after its replay expires until the session is more than 25 months old. A session that is still within the period can keep showing the latest values reported for it.
3. How deletion happens
A scheduled job in our self-hosted analytics environment runs every day and removes records that have passed their period. A record is therefore normally gone within about one day after its period ends. Aggregated, small-number-suppressed daily statistics that do not identify a person are not personal data and may be kept longer.
4. Backups
The scheduled deletion applies to the live analytics database. Copies of records can remain in encrypted disaster-recovery backups of that database. Those backups are not used for analysis and are not covered by the periods above. If a backup is ever restored, we delete records past their period, and records already erased at your request, again before the restored data is used.
5. Your rights
You can ask for access to, or earlier erasure of, the optional analytics and Session Replay records linked to your account through the contact route in the linked Privacy Policy. We find these records through the pseudonymous analytics identifier derived from your account, so activity that was never linked to your account cannot be found or erased this way. Withdrawing your analytics or Session Replay choice stops future collection; it does not by itself erase records already collected, but you may ask us to erase them.