A Discourse service app for handling GDPR deletion requests with role-aware logic. Regular user deletions anonymise the account while preserving contributions — topics, posts, and reactions remain intact. Staff deletions take a different path: accounts are suspended indefinitely, trust level downgraded, group memberships removed, and the account moved to a dedicated former-staff group with a matching title. This keeps the historical record coherent without leaving active credentials behind.
-
The GDPR deletion request is handled differently for staff, and regular users.
-
The request made by the regular users anonymizes their Discourse account, but preserves their contribution, as in topics, posts, reactions, etc.
-
The requests made for the staff accounts on the other hand are preserved as much as possible. The accounts are suspended indefinitely, the trust level downgraded to 1, stripped membership from all user groups, and finally added to a former staff user group with a matching title.
- Create an API key for the
systemuser , or another admin role user, get the API key. - Import
import/data-explorer.dcquery.jsonto Data Explorer in Discourse, and get its ID. - Create a user group for Former staff, and get the group ID.
- Copy
example.envto.env, and update environment variables. - Open the project in your IDE, using the Dev Container
If you are using OrbStack, the application will run at https://privacy-compliance.orb.local
PUT /api/gdpr/{user_id}GET /healthGET /configThis is a restricted endpoint, and only works on local development environment.
- Hono - web application framework
- Prisma ORM - database object-relational mapping
- Got - HTTP client library
- Zod - schema validation library
- Typescript
- Dev Containers
- Biome.js
- ...
This project implements commit linting, based on the Conventional Commit messages specs.
Use pnpm commit instead of git commit to trigger the prompt, for formatted and compliant git commit messages.