Fingerly keeps each kind of data for as long as it is needed for its purpose.
| Data | Kept for | Readable through |
|---|---|---|
| Identification events, including IP addresses | 30 days | The dashboard, the server API |
| Deferred reports | 30 days | The server API, with their event |
| Archived submissions, including deferred reports | 90 days | Not readable; kept to rebuild the event store |
| Webhook delivery history | 30 days | The dashboard |
| Per-address daily summaries | 90 days | Used for detection only |
Per-visitor daily summaries, keyed by visitor_id | 400 days | The dashboard's visitor list and history |
| Velocity counters | 8 days | Used for detection only |
| Visitor identities, which recognise returning devices | 180 days after the device was last seen | Used for identification only |
| Aggregated analytics | Up to 800 days, in aggregate form | Dashboard insights |
| Usage and billing records | About 3 years | Settings > Usage |
Visitor identities
A visitor identity is deleted 180 days after its device was last seen. A device that returns after that is identified as a new visitor, with a new visitor_id and visitor_is_new set to true.
Archived submissions
Every submission is also kept as it arrived, with its signals, the IP lookup and the scoring report, so the event store can be rebuilt. This archive is deleted automatically 90 days after each submission. It is not readable through the dashboard or the API. Erasing a visitor deletes its archived submissions too.
Keeping your own copy
If you need events for longer than 30 days, for example for chargeback evidence, keep your own copy: subscribe to identification.completed, or page through List events on a schedule.
const to = startOfToday()
const from = new Date(to.getTime() - 24 * 60 * 60 * 1000)
for (let page = 1; ; page++) {
const { rows, page_size } = await fingerly.events.list({ from, to, page, limit: 200 })
await warehouse.insert(rows)
if (rows.length < page_size) break
}
Closing an organization
The owner can close an organization in Settings > Organisation. Its keys stop working at once. Thirty days later its data is deleted: keys, projects, team, webhooks, notification settings, visitor identities, stored events and the archive. The organization's billing records, its invoices, payments and credit ledger, are kept as the law requires.