Data handling & retention

Banana Peel keeps run-associated documents for 7 days by default — screenshots, downloaded files, and any artifact bytes we actually copied. After that window they are dropped (lazy on read, and by a sweep at GET/POST /api/cron/expire-artifacts). Benchmarks and smart routing learn from aggregates (success, fail, cost, latency, runner) — not page pixels and not vault secrets.

This is the storage contract, not marketing. If a field is only a link to a provider, we say so.

What is stored, for how long

Data	Default	Enterprise	Copied or linked?	Used for routing analytics?
Screenshots (final frame)	7 days	24h / 7d / 30d; 0 by contract	Copied when Banana Peel inlines the frame (JPEG/PNG data URL on the run + bytes in the artifact store — private GCS bucket with inline Firestore fallback). Remote provider URLs are not kept as the source of truth — they expire on the provider.	No
Session replay / recording	URL stored 7 days; media follows the provider	Same custom window for the stored URL / any copied recording bytes	Usually linked: banana_peel.session.replay_url is the provider’s replay or recording URL (Browserbase, Skyvern, …). Banana Peel does not copy the video. If a runner inlines recording bytes, those copies follow our retention.	No
Downloads / artifact blobs	7 days	24h / 7d / 30d; 0 by contract	Copied when we captured bytes (private GCS bucket; small files fall back to inline Firestore copies). Otherwise linked via a provider URL — that link follows the provider TTL; we do not promise 7 days for uncopied files.	No
Run record / result JSON	Payloads 7 days; outcome metadata kept	Payload window follows custom retention	Copied. After the window: task input, result JSON, steps, screenshot, artifact metadata, and replay URLs are stripped. Id, status, runner, cost, and latency stay for billing/history.	Outcome only (success/fail, runner, cost, latency)
Credential vault	Until you delete it	Until you delete it	Copied and encrypted at rest (AES-GCM). Secrets are write-only — no GET ever returns them.	No
Routing traces (bp_route_traces)	Retained (redacted)	Retained (redacted)	Copied, redacted: domain, task-type, ranked runners, expected-utility features, outcome status/cost/latency. Task text is a redacted preview. No screenshot blobs, no vault secrets, no credential values.	Yes — plus Beta posteriors / benchmark aggregates
Outbound webhook deliveries	7 days	Same window	Copied: event type, HTTP status, latency, capped response-body preview (512 bytes), truncated payload. Signing secrets and customer vault secrets are never stored. Pending retries are kept until delivered or the interaction closes.	No
Long-task orchestration record	Retained (no auto-expiry yet)	Same	Copied: the task input text, the entity manifest (stable ids, labels, per-entity status), budget/spend counters, and a capped event log (newest 200 events). Child runs and their artifacts follow the run rows above — deleting a child response purges its payloads. There is a cancel endpoint but no self-serve delete for the parent record yet.	Outcome aggregates only, via child runs

Direct answers

Normal retention? 7 days for documents Banana Peel copies.
Screenshots? 7 days (copied JPEG/PNG). Then screenshot is null and artifact bytes 410.
Session replays? We store the provider URL for the same window. The video itself lives on the provider and follows their TTL — often shorter. We do not promise 7 days of playable replay.
Can I delete a run? Yes. DELETE /api/v1/responses/:idpurges copied blobs immediately and tombstones the response. Later GET is 404. Another workspace's id is also 404.
24 hours / 7 days / 30 days? Enterprise only, via Console → Account or PATCH /api/v1/workspace. Non-enterprise is fixed at 7 days.
Copied or linked?Bytes we captured are copied into private storage we operate (a private GCS bucket; small files fall back to inline Firestore copies). Provider-hosted files and replays are linked; we don't re-host the video.
Routing analytics? Benchmarks and brain posteriors are counts and EWMAs of success/fail/cost/latency per runner × domain × task type. bp_route_traces keep a redacted decision + outcome (no screenshot blobs, no credential secrets).

Delete a run

Immediate purge of copied screenshots and artifact bytes. The id is retired (tombstone) so it cannot be fetched again. Billing ledger rows for that run are not undone — you already paid for the attempts.

curl -s -X DELETE "$BANANA_PEEL_BASE/api/v1/responses/$ID" \
  -H "Authorization: Bearer $BANANA_PEEL_API_KEY"
# → { "id": "resp_…", "object": "response", "deleted": true }
# later GET /api/v1/responses/$ID → 404 (same as a wrong or other-workspace id)

Enterprise custom retention

Self-serve options: 24h, 7d, 30d. Set them in Console → Account (Enterprise workspaces) or:

curl -s -X PATCH "$BANANA_PEEL_BASE/api/v1/workspace" \
  -H "Authorization: Bearer $BANANA_PEEL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"retention":"24h"}'
# allowed: "24h" | "7d" | "30d"  (Enterprise only)
# GET /api/v1/workspace  →  current policy

Zero retentionand windows longer than 30 days are negotiated on the Enterprise contract (not a PATCH value). When zero-retention is enabled we skip persisting screenshot/artifact blobs: the create response can still include them, then they are discarded. Provider-hosted replays may still exist on the runner's side — we cannot erase Browserbase/Skyvern/… storage we do not operate. Analytics still record the aggregate outcome.

See Pricing (Enterprise) and Security.

How expiry runs

Lazy: GET run / artifact after the window returns stripped payloads (screenshot null, artifacts empty) or HTTP 410 for blob downloads.
Sweep: /api/cron/expire-artifacts (Bearer BP_CRON_SECRET) deletes expired copied blobs in batches. There is no always-on worker; if cron is not configured, lazy expiry still holds.

Benchmarks vs page content

GET /api/v1/rankings and smart-routing posteriors are built from terminal attempt outcomes — not screenshots, not downloads, not vault passwords. A redacted routing trace can include a short task preview with secrets stripped; it is not a copy of the page.