Skip to content

[Backend] — GDPR-style user data export & account deletion #1005

Description

@Olowodarey

Background

Users can sign up and generate data across predictions, markets,
competitions, notifications, leaderboard, etc., but there is no way to
export all of their personal data or to delete an account. This is a common
legal/compliance requirement and is currently impossible.

Goal

A self-contained account module exposing (1) an asynchronous "export my data"
job that produces a downloadable JSON bundle, and (2) an account-deletion flow
that anonymizes/removes personal data while preserving on-chain-referenced
integrity.

Tasks

  1. Entity src/account/entities/data-export-job.entity.ts:
  2. AccountService.requestExport(userId) enqueues a job; a @Cron worker
  3. AccountService.deleteAccount(userId) runs in a transaction:
  4. Controller src/account/account.controller.ts (JWT-protected):
  5. A cleanup @Cron that deletes expired export files + rows. Env EXPORT_DIR,

Acceptance Criteria

  • POST /account/export returns a job id; polling shows pending → ready; the
  • Export files expire and are cleaned up after the TTL; expired downloads 410.
  • DELETE /account anonymizes the user, removes PII tables, and the user can no
  • A user cannot download another user's export (403/404).

Files

src/account/* (new module, entity, service, controller, cron),
src/users/entities/user.entity.ts (add deleted_at),
src/config/env.validation.ts, src/app.module.ts,
src/migrations/<ts>-*.ts.

Metadata

Metadata

Assignees

Type

No type
No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions