Good day, I'm new to backend coding. What do I do to user data that did not confirm verification code from email during registration? Should I save it to database forever or do I have to delete it after a set of limited time when verified boolean is not met? I'm sorry if this is so beginner question.
It's up to you if this is a personal project. You could leave it in the database. doesn't hurt aside from taking up a row. If you wanted to make sure they verified themselves you could disable certain features till they verify other than that, you can leave them in the DB or Delete them after some time (make sure you have some paragraph in your privacy policy section stating that an account will be deleted if not verified after a certain number of days, months etc.). If you are trying to avoid unnecessary spam, then you can implement a captcha This is a great thread that can help answer this question in more detail
https://www.indiehackers.com/post/what-do-you-do-with-unverified-users-e46f6cbe66