28 January 2026 · PDPA
PDPA retention windows for app metrics
Thailand’s PDPA does not publish a magic number of days for product analytics. It asks whether you still need the data for the purpose you stated. Most event tables fail that question quietly by never having a clock at all.
Proxy Servicehub sits in Ratburana. Our PDPA seminar is not a substitute for counsel, but it is where product teams practise writing a clock next to every metric they want to keep. The usual fear is that deletion will destroy quarter-on-quarter charts. The usual reality is that those charts were already mixing identified rows with unidentified ones and nobody trusted them.
Separate the grain
Keep two stores with two clocks. Identified or account-tied events get a short window — often 30 to 90 days unless a regulated product purpose says otherwise. Aggregates (daily counts, activation rates, crash-adjacent session health) get a longer window because they are no longer about a person. If your warehouse cannot separate those grains, retention talk is theatre.
PMs still compare months by reading the aggregate store. They lose the ability to reopen an individual’s funnel from six months ago. That ability was rarely used in launch reviews and was frequently the item counsel asked you to justify.
Write the purpose on the clock
A 13-month retention for “product improvement” is a slogan. A 13-month retention for “seasonal comparison of weekly activation, stored only as counts by app version” is a purpose. The second sentence can be tested. The first cannot.
In critique we ask learners to read the purpose aloud. If it still sounds like “we might need it”, the window is too long or the metric belongs in a consented research export, not in the default SDK.
Deletion must survive retries
A job that deletes rows and then re-ingests them from a cold bucket is not deletion. The flagship runbook module spends an unglamorous hour on retry behaviour. Alumni from the education-app case on our reviews page caught exactly this defect during residency critique.
If you are setting clocks this quarter, start with the events that still carry identifiers. Move aggregates next. Publish both windows internally so support and legal are not inventing numbers on a call.