Lovable Launches Auto-Deletion of "Dead" Apps: 60 Days of Silence, Then the Trash

Lovable, a service where you build apps in a chat with AI, has released a cleanup feature for abandoned projects for Enterprise customers. The rule is simple: if a project goes unused for 60 days, it gets the abandoned status. If an admin has enabled auto-deletion, the project disappears after a grace period of 7, 14 or 30 days. The company also coined the name "undead apps" for such projects and released a free Halloween game in which players hunt for the "undead" among fictional projects. The game does not touch or delete real projects.

The problem created by fast app generation

The easier it is to build a prototype, the more of them pile up. A landing page for a finished campaign, a hackathon prototype, an internal tool built by an employee who has since left: all of these often stay published and connected to data. The industry calls this app sprawl, and Lovable says outright that it affects all AI tools, not just its own platform.

The company lists four risks that build up around forgotten apps:

• Live credentials. A demo for a client meeting may still accept logins, and an API key from a quick experiment may still connect to a corporate system.
• Unpatched vulnerabilities. An event registration form uses a library that later needed a security update. With no owner, the update never ships, and the app stays online with a known hole.
• Personal data with no purpose. Last year's waitlist still holds names, emails and form responses that the business no longer needs.
• A vanished owner. The author of an internal tracker changed teams or left, and nobody is responsible for access, discovered issues or the decision to shut it down.

How the cleanup works: flag, warning, trash

The feature is configured under Workspace settings → Security → Privacy & security → Abandoned projects. It is available only to workspace admins and owners on the Enterprise plan.

The mechanism has two steps. First, Lovable flags a project as abandoned after a period without activity, 60 days by default. The rule applies to both published and unpublished projects. Then, if auto-deletion is enabled, the platform deletes the project after the chosen delay. Auto-deletion is off by default.

The following count as activity:

• editing the project or chatting with it in the editor;
• a visitor visiting the published app (bot traffic is not counted);
• calls to the project's backend functions.

Opening or previewing a project does not count. Publishing by itself does not reset the timer either.

Deletion comes with warnings. Owners and members with edit permissions receive an email and an in-project banner 5 days and 1 day before the deletion date. Anyone with access can stop the process: it is enough to edit the project, send it a message, or click Keep it in the banner or email.

A deleted project can be restored for another 60 days via Workspace settings → Workspace → Recently deleted projects. While it is deleted, the published app is unavailable and the backend is paused. After 60 days, Lovable permanently erases the project, its version history and its chat.

There is a caveat about addresses. After deletion, the lovable.app address is released, and if someone else claims it, a restored project cannot get its old address back.

How to enable it and what to check first

An Enterprise admin needs to open Workspace settings → Security → Privacy & security → Abandoned projects, set the period after which a project is considered abandoned, enable auto-deletion, and choose a grace period: 7, 14 or 30 days.

A practical order of steps:

1. Before enabling the feature, review the list of projects and find those connected to production systems or storing user data. 2.

If some apps are meant to sit without activity, such as seasonal services, make sure someone is responsible for them and will react to the email sent 5 days ahead. Deletion can be stopped by editing the project, sending it a message, or clicking Keep it. 3.

For critical lovable.app addresses, keep in mind that after deletion someone else can take the address. 4.

Separately, revoke API keys and access in the systems that forgotten prototypes were connected to. It is better to pair project deletion with revocation than to use deletion in place of it. 5.

Choose the grace period based on risk: 7 days suits cleaning up experiments, while 30 days leaves more time for teams with long cycles.

The shift itself matters for the market: AI development platforms are starting to sell not only the speed of building apps but also management of their lifecycle. When an app is built in minutes, the question of who will shut it down becomes a security and compliance question.