Auto-delete old form submissions

The problem

Leaving every lead in the database forever is a privacy and security risk. GDPR and similar rules expect data minimization: keep submissions only as long as you need them.

The solution

Each form can auto-delete inbox submissions after a number of days. Retention lives on the Save to inbox action under After submit. When enabled, Sobi Forms permanently removes rows older than that period (based on submission date).

Default when purge is on: 90 days. Turn purge off to keep submissions indefinitely.

How to configure it

1. Open the form in the builder.
2. Go to After submit.
3. Make sure Save to inbox is enabled (required for file uploads).
4. Expand that action.
5. Turn on Purge old submissions (wording may match your admin language).
6. Set the number of days (minimum 1).
7. Save the form.

Purge runs in the background (scheduled after new submissions). Only that form’s entries are affected.

Soft delete vs auto-purge

• Trash in the inbox is a soft delete—you can restore until you permanently delete from Trashed.
• Auto-purge permanently deletes old submissions from the database. It is not the same as moving to trash.

Other privacy defaults

• Visitor IPs are stored as SHA-256 hashes only (for rate limiting)—raw IPs are not kept.
• No telemetry to the plugin author.
• Admin notes stay in the inbox—they are never sent in emails or shown on the front-end.
• Optional Akismet and Turnstile may share data with third parties when you enable them—mention that in your Privacy Policy.

Tips

• Shorter retention (e.g. 30 days) for simple contact forms; longer for support or hiring flows.
• If you only need email alerts and no database copy, remove Save to inbox—then there is nothing to retain (file uploads still require inbox save).
• Exports skip trashed submissions by default; purge removes data before export forever.