Personal data

Your app says which data is about a person, and Jadpo does the rest: it exports that data when the person asks for a copy, erases it when they ask to be forgotten, deletes it when its time is up, and reports where it lives. The aim is that requests under GDPR, UK GDPR and CCPA/CPRA work out of the box.

The law asks a few things of an app:

Keep only the personal data you need, for as long as you need it (GDPR Article 5).
Give a person a copy of everything you hold about them, in a machine-readable form, within a month (Articles 12, 15 and 20).
Delete it when they ask, unless the law makes you keep some of it, such as invoices (Article 17).
Build this in from the start (Article 25), keep a record of what you hold and why (Article 30), and protect it (Article 32).

CCPA/CPRA gives Californians the same rights to know and to delete. Each of these needs the app to know which data is personal and whose it is. That is the one fact Jadpo asks you to write down.

Capability	What you write	What the compiler does
Marking	`personal:` on a field	Hashes it in logs, lists it in the report
The person	`person: true` on an entity	Finds every record that belongs to them
Erasure	`erase:` on references it can't work out	Generates `User.erase(id)` across every store and cache
Export	nothing	Generates `User.export(id)`
Retention	`retention:` on a field or entity	Clears or deletes it when the time is up
Report	nothing	Writes `build/report/personal-data.md`