Messages remain in the Spam folder for 30 days. After that, Gmail permanently deletes them.