Data Retention Policy

Claway keeps every customer's data on their own instance's disk. The gateway process runs a background retention sweep that enforces a configurable TTL per data class. This page tells you what defaults ship, what you can tune, and how to answer procurement's questions.

Defaults

Every field is optional. The values below are the shipped defaults. Anything absent in config.yaml under retention: uses these.

Class	Default TTL	What gets purged
Events (jarvis_ops PG)	90 days	Control actions, tool calls, alerts, telemetry heartbeats
Messages (SQLite state.db)	180 days	User + agent message rows + FTS index
Sessions (SQLite state.db)	180 days	Session metadata (title, model, cost totals)
KB documents	365 days	Uploaded documents older than N days that aren't referenced in any recent session
Audit trail	365 days	audit_events / control_actions — who did what, when
Memories	∞ (999_999 days)	Deliberately effectively-off. Memories are user-authored; deleting them is destructive to Jarvis's persona. Set an explicit value to enable.
Cache files	7 days	~/.claway/cache/{images,audio,videos,documents}/… — inbound media, per-chat scoped since #media-cache-isolation
Sweep interval	6 hours	How often the worker wakes up. Never faster than 5 minutes.

Tuning

# ~/.claway/config.yaml
retention:
  events_days:        30    # aggressive — 30 days of activity trail
  messages_days:     365    # keep a year of transcripts
  sessions_days:     365
  kb_documents_days: 730
  audit_days:       1825    # 5 years — matches most compliance minimums
  memories_days:     999999 # OFF
  cache_days:          3    # cache is a working copy; short is fine
  sweep_interval_hours: 6

Config edits take effect on the next sweep tick — you don't need to restart the gateway. The worker reloads load_gateway_config() on every iteration.

Bounds

The worker clamps every value to [1, 3650] days. A misconfigured events_days: 0 (or negative, or non-numeric) reverts to the shipping default, not "delete everything now."

Log signal

Every sweep emits an INFO line:

retention: purged events=124 messages=8 sessions=2 kb_documents=0 audit=1 memories=0 cache_files=347 errors=0

Grep for retention: in the gateway journal. errors > 0 means one of the sweeps hit an exception — check the WARNING lines just before.

For enterprise procurement

The buyer asks: "How long do you keep our data?"

The answer:

• 90 days by default for operational events.
• 180 days by default for transcripts and sessions.
• 1 year by default for uploaded documents.
• 1 year by default for audit trail (who did what).
• Every one is tunable by editing config.yaml. Range 1 day to 10 years.
• The purge is enforced automatically by a scheduled worker in the gateway process. There is no "someone has to remember to run it" step.
• Memories are user-authored and default to being kept indefinitely — we treat them like customer-owned files, not operational state. Set an explicit TTL to purge them.
• Cache (inbound media working copies) is 7 days by default. These are per-chat scoped since 2026-07 so no accidental cross-chat exposure during the retention window.

The buyer's follow-up: "What if we want to delete a specific tenant's data on demand?" That's the tenant-offboarding runbook — retention is the automatic sweep; offboarding is the on-demand purge.