Repository navigation
[Feature] Complete health-data export, deletion, retention, and recovery #93
Description
Outcome
Give users complete control over every OpenGlucose data class: glucose sessions, readings, events, imported samples, AI artifacts, integration state, settings, and secrets.
Dependencies
- Blocked on the durable identity and migration contract in [Feature] Source-aware health data spine and import identity #89.
- Coordinate with existing per-sensor archive/export behavior; do not regress session-specific exports.
Scope
- Inventory every persisted data class and storage location.
- Add one complete, versioned export bundle with manifest, schema version, hashes, provenance, and preview.
- Add verified full deletion covering databases, archive files, preferences, secure-store keys, model files, temporary shares, sync anchors, and native/background surfaces.
- Define configurable local retention without silently deleting source readings.
- Add authenticated/encrypted recovery bundle design and restore validation.
- Add machine-readable CSV/JSON export plus readable report generation after canonical data export is correct.
- Exclude temporary/recovery artifacts from platform backups as required.
Parallelization
Schema-independent threat modeling, manifest design, UX copy, and deletion inventory can start now. Database implementation waits for #89. One owner must coordinate migrations and destructive operations.
Acceptance criteria
- A complete export includes every opted-in data class and clearly lists exclusions.
- Restore round-trips a representative multi-sensor, meals, sleep, workout, HR, integration, and AI fixture.
- Delete all leaves no recoverable app-owned health data or keys after relaunch.
- Interrupted export/restore/delete operations fail closed and are recoverable.
- Retention rules are explicit, previewed, reversible where possible, and tested at boundaries.
- Temporary files are minimized, removed, backup-excluded, and never logged.
- Corrupt, future-version, partial, and tampered bundles are rejected safely.
- Accessibility, privacy documentation, rollback plan, and R2 independent review are complete.
Product boundary
No export or recovery path may silently upload data or imply cloud backup.
Repository-owner recreation of the legacy issue at #40. The original discussion remains available there.
Activity