Expiry and retention

A document with an expiry is removed from access and deleted the instant it passes. Expiry is a control you set from Share Settings on every plan, including Free: pick any window, or none at all. Only anonymous uploads carry a fixed lifetime.

Setting document expiry

Every upload is created with a starting expiry, which you then change from Share Settings on the Configure & Share screen. A signed-in upload starts with no expiry at all, on every plan, so a document is never born with a shorter life than you would have chosen for it — set a window yourself if you want one. The starting values are:

Change the expiry by picking a new window from the expiry selector and applying it; the new window is measured from the moment you apply it, not from upload. The selector offers 1 hour, 12 hours, 24 hours, 7 days, 30 days, 365 days and Never on every plan.

Once the expiry instant passes, the document is inaccessible immediately, even if the cleanup process has not yet run.

What readers see

While the link is live, the viewer shows a running Expires in countdown beside the Download button, so a reader knows how long they have. It appears only on documents that expire, and you can switch it off per document with Show expiry to readers in Share Settings, directly under the expiry selector. With the countdown off, the public metadata no longer carries the expiry at all.

Once the link has lapsed, a reader who opens it sees a page naming the document and the date it expired, rather than a bare "not found". Where the expiry was one of the no-account defaults, the page also says so: anonymous uploads expire after 7 days, Canva documents published without an account after a year, in each case with a pointer to creating or connecting an account. An expiry you set yourself is stated as your choice, with no nudge. The same page appears for a document that reached its view limit, or that was deleted, with the wording adjusted; in those cases it gives the name and date only.

The name is withheld if the document was password-protected or behind an email gate when it went, so an old link to a gated document confirms nothing about what it was. Link previews in chat apps and social networks stay generic for any dead link, for the same reason.

The page is served for as long as the record of the deletion exists, which is indefinitely. On a custom domain a dead link answers a plain not-found instead.

Expiry limits

Signed-in accounts have no expiry cap on any plan: schedule any window, or choose Never, which stores no expiry at all and exempts the document from the cleanup sweep.

The one cap is on anonymous documents edited through a manage token (the credential the API returns alongside an anonymous upload). Those writes are held to 7 days from now and cannot set never-expire; anything longer is rejected with HTTP 403. Claim the document into an account to lift the cap.

Automatic cleanup

A background process runs every 60 seconds to remove expired documents from disk and the database. A document that has passed its expiry instant returns HTTP 410 (Gone) on any download request immediately—it does not wait for the next cleanup cycle. The public metadata endpoint answers the same 410 with a JSON body (reason, why, endedAt, and originalName unless the document was gated) before and after the sweep alike, which is what the viewer's expired page is built from; every other endpoint answers with plain text. Because the cleanup runs periodically, an expired document's database row can survive up to a minute, so every write lane refuses expired documents with 410 as well: the settings endpoint (on all of its authentication lanes), the download-permission toggle, the viewer-mode endpoint, and content replacement. Without those refusals, a write inside that window could push the expiry into the future and resurrect a link that had already answered 410 to its readers.

Extending the expiry of a document that has not yet lapsed is the supported flow and is not affected—the refusal applies only to documents that are already past their expiry instant.

Anonymous uploads and expiry

Unclaimed anonymous documents (uploaded without an account or shared before signing up) are retained for 7 days. This window starts from the document's creation and allows shared links to remain live even after the uploading session ends. Documents published from Canva are the exception: they are retained for 365 days from publishing, and republishing a live design restarts that clock. Claiming an anonymous document by signing up or logging in makes it yours, and it takes on the signed-in default: the expiry is cleared and the document stops expiring. The one exception is an expiry the uploader chose explicitly through the manage token—that is kept, because the link may already have been shared on that promise. Either way the share link keeps working, and once claimed you change the expiry from Share Settings like any other document, including to never.

See Anonymous uploads and claiming for details on how claiming works.

Expiry when restoring from trash

When you restore a document from trash, its expiry is handled like this:

Restored documents keep their stored expiry on every plan, never-expire included. If that expiry lapsed while the document sat in trash, it is cleared instead—the restored document never expires until you set a new expiry.

The lapsed-expiry re-basing matters because the cleanup sweep deliberately skips trashed documents, so a stored expiry can pass while a document is in the trash. Without the re-base, the restore would succeed and the next sweep would delete the document moments later, with the expired-document 410 on the settings endpoint blocking any rescue in between.

See Trash and recovery for more details on the restore process.

Expiry vs. view limits

Expiry and view limits are separate controls:

• Expiry: Time-based. The document becomes inaccessible after a specific date and time, regardless of how many times it has been viewed.
• View limit: Count-based. The document becomes inaccessible after a set number of viewing sessions have been served, regardless of time.

Both can be combined on the same document. See Self-destructing links for details on view limits.

Plans and limits

For an overview of your plan's capabilities, see Plans and limits.