Add Yeeter privacy deletion and export endpoints

[3kh0]

Summary of the problem

Hackatime needs to handle centrally signed privacy requests without exposing personal identifiers or changing account data during previews.

Describe your changes

• Add signed delete and count-only export endpoints for the hackatime audience, with database-backed replay protection.
• Execute the same transactional erasure for previews and real deletions, rolling previews back and removing files before committing real deletions.
• Keep shared moderation decisions and repository records detached from the subject. Leave existing self-service deletion unchanged.
• Document the data inventory, manual review cases, full-cache clearing and external-service boundaries in docs/privacy.md.
• Suppress privacy request telemetry and render erased audit actors as Deleted user.

Screenshots / Media

Synthetic development accounts only.

Audit records before and after detaching an actor

Ordinary actor:

Detached actor:

Both states in the audit list:

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	gem/​jwt@​3.3.0

View full report

[greptile-apps]

Confidence Score: 5/5

[Critical impact] The PR appears safe to merge, with a non-blocking request to restore the privacy operator guide.

Summary

Adds signed privacy deletion and count-only export endpoints.

• Yeeter can request a count or deletion through signed privacy endpoints.
• Delete previews and real requests use the same account-erasure path.
• Privacy requests leave only a request ID and outcome in routine logs.
• Moderation decisions remain readable after their actor is detached.

Both earlier, unnumbered findings are addressed: history matching now checks complete identifier values, and activity cache calculations share a lock with deletion.

Diagram

sequenceDiagram
  participant Y as Yeeter
  participant A as Privacy API
  participant D as Database
  participant S as Files and cache
  Y->>A: Signed delete or export request
  A->>A: Verify signature and claims
  A->>D: Consume replay receipt
  A->>D: Find matching records
  alt Export
    A-->>Y: Held record counts
  else Deletion preview
    A->>D: Erase records, then roll back
    A-->>Y: Preview counts
  else Real deletion
    A->>D: Erase records in transaction
    A->>S: Remove files and clear cache
    A->>D: Commit
    A-->>Y: Deleted and retained counts
  end

Loading

_{Reviews (3) · Last reviewed commit: "Delete docs/privacy.md" · Reviewed by Greptile}