Repository navigation
[Feature] Complete health-data export, deletion, retention, and recovery #40
Description
Outcome
Give users complete control over every OpenGlucose data class: glucose sessions, readings, events, imported samples, AI artifacts, integration state, settings, and secrets.
Dependencies
- Blocked on the durable identity and migration contract in [Feature] Source-aware health data spine and import identity #36.
- Coordinate with existing per-sensor archive/export behavior; do not regress session-specific exports.
Scope
- Inventory every persisted data class and storage location.
- Add one complete, versioned export bundle with manifest, schema version, hashes, provenance, and preview.
- Add verified full deletion covering databases, archive files, preferences, secure-store keys, model files, temporary shares, sync anchors, and native/background surfaces.
- Define configurable local retention without silently deleting source readings.
- Add authenticated/encrypted recovery bundle design and restore validation.
- Add machine-readable CSV/JSON export plus readable report generation after canonical data export is correct.
- Exclude temporary/recovery artifacts from platform backups as required.
Parallelization
Schema-independent threat modeling, manifest design, UX copy, and deletion inventory can start now. Database implementation waits for #36. One owner must coordinate migrations and destructive operations.
Acceptance criteria
- A complete export includes every opted-in data class and clearly lists exclusions.
- Restore round-trips a representative multi-sensor, meals, sleep, workout, HR, integration, and AI fixture.
- Delete all leaves no recoverable app-owned health data or keys after relaunch.
- Interrupted export/restore/delete operations fail closed and are recoverable.
- Retention rules are explicit, previewed, reversible where possible, and tested at boundaries.
- Temporary files are minimized, removed, backup-excluded, and never logged.
- Corrupt, future-version, partial, and tampered bundles are rejected safely.
- Accessibility, privacy documentation, rollback plan, and R2 independent review are complete.
Product boundary
No export or recovery path may silently upload data or imply cloud backup.
Activity
shroominic commentedon Sep 1, 2026
Superseded by #93, recreated by the repository owner under
shroominic.