Data export, retention, and deletion¶

You can download a copy of your account data, understand how long workspace history is kept, and request account deletion from the dashboard.

Downloading your data¶

Open Profile in the dashboard.
Open the Account tab.
In the Data & Privacy section, click Download my data.

Your browser downloads a JSON file with your profile, every workspace membership (and sites per membership), owned workspaces. Passwords and API keys are not included. Billing address and VAT are not exported from Patcherly by default (billing_identity: managed_by_stripe); manage those in Stripe Checkout or the Customer Portal.

How long data is kept¶

TL;DR: pruning or deleting errors does not erase your metrics. Headline numbers (errors fixed, time saved, money saved, AI usage) come from a separate, permanently kept aggregated store. Only the raw error and analysis history older than your plan's window is removed.

Kept indefinitely (for the life of your workspace)¶

Aggregated metrics - daily / monthly counts that power the Metrics page (including All Time)
AI usage records - request, token, and cost summaries for Usage and Profile → AI
Account data - workspace, user, site, billing, and settings (follow deletion rules in the Privacy Policy and this page)

Pruned by plan (audit / error detail)¶

Plan	Audit data retention
Personal	30 days
Core	90 days
Pro	Unlimited

After that window, raw error and analysis logs, patch outcome details, and app-level audit entries used by the Audit page are pruned daily. See Audit Logs.

Per-fix metrics export (Metrics → Export fix outcomes) only has row-level detail for roughly the last 90 days. Older ranges return empty detail rows; aggregated KPI cards are unaffected. See Understanding metric cards.

If Errors or Audit looks empty for an old date range, your plan window may have pruned that detail - Metrics headlines for the same period stay correct.

Plan downgrades - 30-day grace¶

After a downgrade to a shorter retention plan (for example Pro → Core), Patcherly keeps the longer of the old and new windows for 30 days, then applies the new window on the next daily prune.

Pre-apply backups¶

Connector backups live on your server, not on Patcherly. They are not pruned by this retention policy. See How rollback works and the FAQ on backups.

Requesting account deletion¶

Workspace owners and invited team members use the same Profile control, but the effect differs:

Who you are	What deletion does
Invited team member (no owned workspace)	Removes your login only. Workspaces you joined, their billing, sites, and other team members stay.
Owner of one workspace	Deletes your account and that workspace (team members with only that membership are included per our privacy policy).
Owner of multiple workspaces	Blocked until you delete extra workspaces from Your workspaces on Profile.

Open Profile → Account.
If you own multiple workspaces, delete extras under Your workspaces first.
In Delete Account, follow the prompts to request deletion.

When you request deletion, your account is marked as pending deletion and scheduled for removal (maximum 7 business days). You can still sign in until processing starts, but processing can begin at any moment. Owners with a paid subscription on an owned workspace: renewal is set to cancel at the period end. Invited team members do not change billing on workspaces they joined. You'll receive a confirmation email with this timeline and a support contact in case the request was a mistake. Once deletion processing starts, recovery cannot be guaranteed and data can be permanently lost. What is deleted, retained, or exported is described in our legal policies: https://patcherly.com/legal/privacy-policy

Error and analysis data¶

How operational error and analysis data is handled - including retention and what appears in exports - is covered in our legal policies: https://patcherly.com/legal/privacy-policy

Audit logs in the product: The dashboard Audit page lists events with an Actor column showing a resolved name or email when available (or labels such as System / Connector / Patcherly Support), not a bare numeric user id. Email addresses stay stored with your account as part of Patcherly's normal records and are only shown in the Actor column when no display name is set. App-level rows show object type and object ID for the audited resource; operational rows may include extra context in metadata and (when recorded) IP address / user agent in the event detail view. See Audit Logs for the filters, columns, and CSV export.

Manual delete of an error (when allowed) removes that row and related analysis; it does not shrink headline Metrics or Usage numbers. Delete is blocked once a patch was successfully applied or after a completed apply attempt - use Hide Error & Ignore for list cleanup instead.

What gets deleted, and when¶

Account deletion in Patcherly happens in two phases - at the moment you click Delete, and again at finalisation (within seven business days, or at the end of your paid period if you have a paid subscription). Each phase touches different things:

At the moment you request deletion¶

Your account is flagged deletion pending. You can still sign in - and cancel - until processing starts.
Connector OAuth tokens are revoked within seconds so your connectors stop pulling fixes immediately. See What happens to your connectors when you delete your account below.
If you have a paid subscription, Stripe is told to cancel renewal at the end of the current billing period. You keep the paid features until then.
If you don't have a paid subscription, your workspace is moved to the Personal (free) plan immediately.
A confirmation email goes out with the deletion timeline and a support contact in case it was a mistake.

Your name, email, billing details, errors, analyses, audit history, and AI usage are all still present at this point - they are removed in the next phase.

At finalisation (within ≤7 business days, or paid-period end)¶

Your account is hard-deleted from Patcherly's primary stores (Postgres account/workspace/sites/OAuth tokens; Mongo in-app notification inbox for deleted users).
Your name, email, phone, IP, user-agent, and other personally identifying fields (including any residual address/VAT keys on operational records) are unset from every operational record (errors, analyses, audit history, patch outcomes), which are stored on a separate operational store/database. The records themselves stay - keyed by pseudonymous numeric IDs only - so Patcherly overall metrics history remain accurate over time. Invoicing identity on Stripe is separate and follows Stripe's retention.

Deferred physical deletion¶

After ~180 days from finalisation - those operational records (errors, analyses, audit history, patch outcomes) are physically deleted by a daily background task.
After ~730 days (~2 years) from finalisation - AI usage records (token counts and cost per provider/model) are physically deleted. This longer window is described in our privacy policy.

This is what our privacy policy calls the operational data store: between finalisation and the deferred physical purge, the records still exist but are flagged as belonging to a deleted account and keyed by pseudonymous numeric IDs only - never by your name or email.

Long-term aggregates keep only pseudonymous numeric identifiers, timestamps, and categorical connector metadata (e.g. "WordPress", "Python"). Your name and email are never retained in that store.

Exact windows are set out in our legal policies.

Dormant free workspace policy¶

Personal-plan workspaces can be marked dormant when both conditions are true for 12 continuous months:
no member login activity, and
all sites are inactive, not connected, or have no connector activity.
Before deletion eligibility, Patcherly sends a 30-day notice email to the workspace account.
You can control this email/in-app notice in Profile → Notifications using the Dormant Workspace Notice event preference (signed in as the workspace owner).
If any team member logs in during that notice period, the workspace is kept and the notice is cleared.
If no member logs in during that notice period, the workspace and related data may be deleted.
Paid-plan workspaces are not affected while the paid subscription remains active.

If you create an account but never finish registration (no workspace yet), Patcherly may send reminder emails and permanently remove that account after a short configurable period (default 14 days). This is separate from the dormant free-workspace policy above and does not apply once a workspace exists. See the Privacy Policy.

What happens to your connectors when you delete your account¶

When you request account deletion, Patcherly immediately revokes every connector OAuth token issued under your account - even though the grace period for the database records is longer. This means:

Connectors on your servers stop receiving fixes within seconds.
Refresh-token attempts from those connectors return invalid_grant.
If you cancel the deletion request before the grace window ends, you can re-pair each connector by running patcherly login (CLI) or re-installing the WordPress plugin.

The same immediate revocation applies when you delete a site or app or your workspace from the dashboard, or when Patcherly support performs the deletion on your behalf. Connector backup folders on your own server are not touched - those follow your own retention policy (see Where are my backups stored?).