Your server, nothing else
Karelia Trash keeps the copies on your own server (or the filesystem disk you choose) as plain JSON files and the original asset files. It needs no database, makes no network requests and never contacts us.
Where your data goes
Only on your own server, or on the Laravel filesystem disk you configure for the trash (for example S3, under your own agreement with that provider). The addon makes no network requests. It never contacts Karelia Labs: it has no telemetry, no analytics and no account with us. Statamic itself checks licence keys with statamic.com; that is part of Statamic, not of the addon.
What is stored
Everything the addon stores is in one folder on the disk you choose, by default storage/app/private/statamic-trash, outside the public web folder.
| Data | Where and why | How long |
|---|---|---|
| Deleted entries, terms and global sets: every field, slug, date, publish state, blueprint and place in the page tree | The trash folder, one JSON file per item. Restore it | Until restored or deleted for good, at most the retention period (30 days by default) |
| Deleted assets: the file itself and its fields, up to the size you set (100 MB by default) | The trash folder. Restore the file | As above |
| Deleted form submissions: every value the visitor entered | The trash folder. Restore the submission | As above |
| Deleted users, only if switched on: email, name, roles, groups and profile fields, never passwords, passkeys or two-factor secrets | The trash folder. Restore the account | As above |
| Who deleted each item, and when | The trash folder. Shown in the trash | As long as the item |
| Settings: retention period, types to keep, largest asset | Statamic's addon settings. Run the addon | Until changed |
Personal data
Trashed form submissions and users hold personal data until they expire, are restored or are deleted for good. Trashed content may contain personal data written by editors. The trash records the id and name of the Control Panel user who deleted each item. Your site is the controller of this data. Use a short retention period, Delete Forever, the exclude option or the type settings to match your privacy policy and to answer erasure requests.
Permissions
The addon adds three Statamic permissions in a Trash group under Users, Roles, and checks them on the server for every request.
| Permission | Why the app needs it |
|---|---|
| View the trash | Open the trash. Users see only items they could view before deletion, such as entries in collections they have view access to |
| Restore items | Restore. Also requires the right to create that kind of item, such as create blog entries, upload assets or configure globals |
| Delete items forever and empty the trash | Use Delete Forever and Empty Trash |
Access control
Every request is checked on the server: the trash permission, the right to see the item's collection, taxonomy, container, form or site, and for restores the right to create that kind of item. Super admins can do everything, and only a super admin can restore a super admin.
Untrusted input
Deleted content is stored and shown as data, never run. Previews are rendered by Statamic's Control Panel components, which escape text. A deleted file is served to the preview with a strict content security policy that blocks scripts, also inside SVG files, and with content sniffing turned off.
Dependencies
The addon depends only on Statamic and Laravel, installed by Composer. Its Control Panel script is built with Statamic's own Vite tooling against Statamic's components and bundles no third-party code.
Other points
If the trash cannot be written
By default the deletion goes ahead and the error is logged, so a full disk never stops editors from working. Set on_failure to block to stop deletions instead.
Several servers
Put the trash on a shared disk such as S3 so every server sees the same trash. Writes are made under a cache lock, so two deletions at the same moment do not overwrite each other.
Logging
The addon writes nothing to logs during normal use. If a copy cannot be written, an error with the type of item and the reason goes to Laravel's log. Content is never logged.
Sub-processors
None. We receive no site data, so there is nothing to pass on. Licences and payments are handled by Statamic and Stripe. For the other parties involved in our own support and bookkeeping, see the privacy policy.
AI and language models
None. The addon contains no language model and sends no content to any.
Vulnerabilities
Report a suspected vulnerability to support@karelialabs.atlassian.net. Please include what you found, how to reproduce it and which version is affected, and give us a reasonable time to fix it before you publish details. We read every report.
Deleting data
Items are deleted for good when their retention period ends, with Delete Forever, with Empty Trash, or with php please trash:purge --all. Removing the addon with Composer leaves the trash folder in place; delete the folder to remove what it holds.