# Retention and deletion

> How ClickClacks handles IP addresses and location, how long events and heatmap captures are kept on each plan, how to export your data, how deletion works, and practical GDPR guidance for your ClickClacks setup.

- Canonical URL: https://clickclacks.io/docs/data
- Section: Data & privacy
- Last updated: 2026-09-26

What ClickClacks keeps about your visitors, for how long, and how to get it out or have it removed. Plus a short checklist for running ClickClacks under GDPR.

> **Not legal advice**
>
> This page describes how the product behaves so you can make your own assessment. The [privacy policy](https://clickclacks.io/privacy) and [terms](https://clickclacks.io/terms) are the documents that govern it.

## IP addresses and location {#ip}

- **IP addresses aren’t stored by default.** Each source has a **Record IP address** setting (“Off means country only, from the edge”). It’s off unless you turn it on.
- **Country** comes from Cloudflare’s network as the request arrives, without storing the address it came from.
- **Browser, operating system and device type** are read from the user agent, which is then discarded.
- **Server events** follow the same rule: `$ip` is kept only when the source records IP addresses, and `$user_agent` is never stored raw.
- **No fingerprinting.** A visitor is recognised only by the random ID in their browser’s storage, never from their IP address or device.

## Retention {#retention}

| What | How long |
| --- | --- |
| Raw events | The period chosen for the project: 3, 12 or 24 months. Your plan sets the most: 12 months on Growth, 24 on Pro. |
| Heatmap captures | 30 days. The newest capture of each page and device size is always kept, so a heatmap never goes blank. |
| Organization exports | The download is available for 24 hours after it’s ready. |
| A deleted organization or account | A 30-day window in which it can be restored, then permanently removed. |

You choose how long to keep raw events when you create a project (**Keep raw events for**). Your choice is saved straight away. Automatic enforcement, which removes raw events once they pass that age, is still being switched on; until it is, contact us if you need older events removed sooner.

## Exporting data {#export}

- **Events:** export the rows you’re looking at in **Events** as CSV, up to 50,000 at a time.
- **Reports:** insights and funnel drop-offs have **Export CSV**, and each board has **Export as CSV** in its menu.
- **Everything in an organization:** an organization Owner can request an export in the organization’s settings. It arrives as a ZIP of JSON files: each project’s configuration (sources, identity links, funnels, segments, insights, boards, experiments, alerts) and its raw events. Events are included for organizations with up to 50,000 in total; above that the export can’t complete yet, so export events from Events instead.
- **Your own account:** export your personal account data from your account’s data and privacy settings.
- **Through the API:** the [MCP server](https://clickclacks.io/docs/mcp.md) reads every report with a key.

## Deleting data {#deletion}

- **An organization:** an Owner can delete it from the organization’s settings. Access stops at once; for 30 days it can be restored, and then its data, including every project’s events, is permanently removed.
- **Your account:** the same 30-day window applies.
- **A source:** **Remove this source**, on the source’s page, stops collection immediately.
- **One person’s events:** there’s no self-serve button yet. [Contact us](https://clickclacks.io/contact) with the person’s ID to have their events removed.
- **A key:** revoking a server key or an MCP key takes effect on the next request.

## GDPR checklist {#gdpr}

What most teams do when they set up ClickClacks for European visitors:

1. **Decide on consent.** The tracker sets no cookies but does use browser storage. Choose between loading it only after consent and opting visitors out: see [Consent and opt-out](https://clickclacks.io/docs/consent.md).
2. **Keep IP recording off** unless you need it.
3. **Send IDs, not identities.** Use an internal user ID with `identify` and as `distinct_id`, never an email address.
4. **Keep personal data out of URLs and properties.** The tracker strips well-known sensitive parameters, but can’t know what your paths and custom properties mean. [What isn’t scrubbed](https://clickclacks.io/docs/privacy.md#not-covered) lists the gaps.
5. **Mask personal content** in heatmap captures with `data-cc-mask` or skip selectors.
6. **Pick the shortest retention** that answers your questions.
7. **List ClickClacks** in your own privacy notice as the analytics service you use.

## Requests from your users {#requests}

- **Access:** find the person in **People**. Their profile shows their activity, and **Open in Events** lists every event, which you can export as CSV.
- **Erasure:** [contact us](https://clickclacks.io/contact) with their ID. To stop collecting from their browser straight away, [opt them out](https://clickclacks.io/docs/consent.md).
- **Objection:** opt-out is remembered in the browser, per hostname, until they opt back in.

## Next steps {#next}

- [What’s collected](https://clickclacks.io/docs/privacy.md): every field and storage key.
- [Security](https://clickclacks.io/security): how ClickClacks is run.
- [Limits](https://clickclacks.io/docs/limits.md): sizes and rates.