Data, Retention & Deletion
This page is the canonical map of where Anyy stores data, how long the runtime keeps high-volume records, and which commands create, export, prune, or delete local data. Other pages link here instead of repeating the storage layout.
Anyy is local-first: the authoritative state lives under one Anyy home directory for the active profile. Model and service providers only receive the prompt, context, tool results, media summaries, or credentials needed for the specific operation you configure.
There is no hidden cloud account that can restore local data if you delete it. Before destructive cleanup, create a backup and check which profile/home you are targeting.
Before You Delete Anything
-
Confirm the target home.
anyy status --home ~/.anyy -
Create a backup unless you are intentionally discarding the data.
anyy backup create --home ~/.anyy -
Stop the resident gateway for the profile if you are deleting a profile or uninstalling the targeted home.
anyy gateway stop --home ~/.anyy
/compress, /compact, gateway stop, and switching profiles are not privacy
deletion operations. They change context shape, display, runtime state, or active
selection, but they do not remove stored local data by themselves.
Where Data Lives
The home directory is resolved from, in order, an explicit --home PATH, an
explicit --profile NAME, ANYY_HOME, the active profile selection, and
then the default install home. The effective layout is represented by
internal/workspace.Paths.
Common paths:
| Path | Purpose |
|---|---|
config.yaml | Profile configuration: providers, models, gateway, channels, toolsets, MCP, media, retention, and storage policy. |
state.db | SQLite state database for sessions, messages, roles, memory indexes, audit records, cron state, channel bindings, artifacts, and runtime metadata. |
secrets/ | Profile-local secret files addressed by secret: references. |
memory/ | File-backed memory material such as MEMORY.md, USER.md, daily notes, topic notes, and archives. |
workspace/ | User-visible work area and exported artifacts. |
logs/ | Runtime logs that local diagnostics can find. |
raw/ | Raw per-session JSONL records used for retention, summary, and recovery workflows. |
backups/ | Backup archives and pre-restore snapshots. |
cache/ | Runtime cache and temporary staged media. |
skills/ | Installed skill packages. |
roles/ and SOUL.md | Role persona files. |
cron/ and channels/ | Runtime-owned channel and scheduled-work state. |
anyy.sock | Default Unix socket for the local gateway. |
runtime.json | Runtime metadata, including an alternate socket path when one is active. |
State database
state.db is the primary durable database. It stores sessions, message parts,
session summaries, memory records and indexes, role metadata, approvals,
ChangePlans, audit events, artifacts metadata, cron jobs, channel bindings,
background jobs, MCP/runtime metadata, and maintenance bookkeeping.
SQLite sidecar files such as state.db-wal, state.db-shm, and journal files
may appear while the database is open. Backups skip those sidecars and use a
SQLite backup path for the database itself.
Secrets
Secrets can be referenced in four forms:
| Ref | Meaning |
|---|---|
env:NAME | Read the value from environment variable NAME. |
file:/absolute/path | Read the value from an arbitrary file path. |
secret:relative/name | Read a profile-local file under secrets/relative/name. |
literal:value | Use the literal value. Intended for local testing and non-secret values. |
secret: refs are constrained to stay under the profile's secrets/ directory.
The resolver rejects absolute paths and .. escapes. Secret files are listed by
name through the secrets catalog, but values are resolved only when a provider,
channel, MCP server, or tool needs them.
Memories
File-backed memory lives under memory/. The implemented file targets are:
| File or directory | Meaning |
|---|---|
memory/MEMORY.md | Core long-term memory. |
memory/USER.md | User profile memory. |
memory/daily/YYYY-MM-DD.md | Daily memory notes. |
memory/topics/<slug>.md | Topic-specific memory notes. |
memory/archive/<slug>.md | Archived memory notes. |
Memory paths are validated so relative paths cannot escape the memory root.
Raw logs
Raw records are stored under raw/YYYY/MM/DD/<session>.jsonl. Each record is a
complete JSONL line. The raw log implementation repairs torn final lines and
can read records by segment/offset, which lets the database keep compact
references while raw detail remains on disk.
Raw storage is governed by the storage and retention policy. The current
defaults keep a hot raw window, use a 30 MiB effective raw quota when no total
ceiling is configured, and keep high-volume raw data shorter than the durable
session summaries.
Artifacts
Artifacts are metadata records in state.db plus files under the profile home
when Anyy owns the bytes. Generated output and channel attachments use
scoped private blob paths such as private/blobs/<artifact_id>/<filename>.
Trusted local files and skill-supporting files can be registered as artifacts
without copying all bytes into the private blob store.
Artifact files are written with private permissions, and artifact records carry source, storage class, content type, size, checksum, status, and scope metadata.
Backups
anyy backup create writes a tar.gz archive with a manifest.json.
Backups include regular files under the Anyy home, skip SQLite sidecars,
and exclude secrets/ by default.
anyy backup create --home ~/.anyy --output ./anyy-backup.tar.gz
anyy backup create --home ~/.anyy --include-secrets --output ./full-backup.tar.gz
anyy backup list --home ~/.anyy
Use --include-secrets only when the archive will be protected like a password
vault. Backup files are created with private file permissions.
Retention & Cleanup
Retention is explicit config, not a cloud-side policy. The main knobs live under
storage and retention:
| Field | Default / behavior |
|---|---|
storage.hot_window_hours | Default 72; influences how recent raw data remains active. |
storage.preview_bytes | Default 1024; used as the message preview/search-text size unless legacy retention fields override it. |
storage.blob_threshold_bytes | Default 4096; larger payloads can move to blob storage. |
storage.raw_ttl_days | Default 30; raw storage lifetime policy. |
storage.raw_quota_bytes | 0 resolves to a calculated quota; default effective quota is 30 MiB. |
storage.state_db_soft_target_bytes | Default 8 MiB target for database maintenance. |
retention.enabled | Enabled by default. |
retention.short_term.raw_days | Defaults from storage.hot_window_hours unless explicitly set. |
retention.state_db.journal_size_limit_bytes | Defaults from storage.state_db.journal_size_limit_bytes. |
Maintenance commands act on this local state:
anyy maintenance checkpoint-state --home ~/.anyy
anyy maintenance compact-state --home ~/.anyy --output ./state-compact.db
anyy maintenance prune-inactive-sessions --home ~/.anyy --raw-days 14 --execute
anyy maintenance cache-token-estimates --home ~/.anyy --execute
anyy maintenance migrate-lifecycle --home ~/.anyy --raw-days 14 --execute
Run the same commands without --execute where supported to preview the work.
Export Your Data
For whole-profile export, use a backup archive. By default, this exports config, state, memory, skills, logs, artifacts, channel state, and other regular files while excluding secrets:
anyy backup create --home ~/.anyy --output ./anyy-backup.tar.gz
For a sensitive full export, include secrets:
anyy backup create --home ~/.anyy --include-secrets --output ./anyy-full.tar.gz
For a single interactive conversation, use the TUI /save command. It exports
the current session transcript to the configured export directory under the
profile workspace.
Delete Your Data
Use the narrowest deletion path that matches what you mean:
| Goal | Command or action |
|---|---|
| Stop using a non-default profile | anyy profile delete NAME --force |
| Delete a non-default profile that contains secrets | anyy profile delete NAME --force --purge-secrets |
| Remove code but keep profile data | anyy uninstall --keep-data --yes |
| Remove code and all targeted profile data | anyy uninstall --full --yes |
| Prune inactive session raw data | anyy maintenance prune-inactive-sessions --execute |
profile delete refuses to delete the active profile, refuses to delete the
default profile, and refuses a profile whose gateway is still running. Switch
profiles and stop that profile's gateway first.
anyy uninstall --full --yes is the broadest local deletion command. Verify
the effective --home path before running it, especially on hosts where multiple
profiles or service installs exist.
What Leaves the Machine
Anyy sends data out only through configured backends and integrations. The usual outbound paths are:
- Model provider requests: prompts, selected session context, tool results, media summaries, and system/developer instructions needed for a turn.
- Provider or channel authentication: API keys, OAuth credentials, bot tokens, or platform-specific credentials referenced by config.
- Messaging channels: inbound and outbound message text, attachments, typing indicators, and delivery metadata for the configured platform.
- MCP servers: prompts, resources, tool arguments, and tool outputs for servers you explicitly configure and expose.
- Browser/computer-use integrations: local automation state needed by those optional capabilities.
Anyy itself remains Anyy in every surface. Provider names and channel names describe configured backends; they do not become the assistant's identity.