Nope, that's a bit tricky and depends greatly on deployment   environment. In a cluster, which machine runs the delete, how often,   if it just happens by default there's odd lock conditions, etc. It's   safer to let the person deploying it use the appropriate strategy.

If you're using db session, it does store last accessed time for each   session. There's no reason you can't have a very simple SQL command   that runs every day to clear the ones with the accessed timestamp > 2   days or whatever.