Problem
There is no retention limit on visitor data. No TTL, no scheduled purge over page_views / sessions / custom_events / conversions. app/Scheduler.ts:20 only has a commented-out cleanup example. Records are kept indefinitely.
Why it matters (privacy-first)
Every strict competitor (Plausible, Fathom, Simple Analytics, Umami) offers retention controls; unbounded retention of even pseudonymous data is hard to defend under GDPR data-minimisation.
Proposed fix
Add a configurable retention window (per-site, default e.g. 24–36 months) and a scheduled job that prunes rows older than the window. Surface the setting in site settings (see site-management issue). Pairs with the deletion/erasure issue.
Priority: P0.
From the 2026-07-20 privacy-first competitive audit (vs. Plausible / Fathom / Simple Analytics / Umami).