Skip to main content

User Data Export (Privacy Feature)

Status: ✅ Complete
Last Updated: 2026-01-25

Overview​

Zero-knowledge encrypted data export system that allows users to download all their data in a secure, encrypted format. The system uses AES-256-GCM encryption with user-provided passwords, ensuring the server cannot decrypt exports (zero-knowledge architecture).

Implementation Details​

Core Infrastructure​

Task Queue Infrastructure​

  • ✅ pg-boss PostgreSQL-based task queue installed and configured
  • ✅ TaskQueueService with job enqueueing, processing, status checking, and cancellation
  • ✅ Integrated into server startup with graceful shutdown
  • ✅ Retry logic configured (5 retries with exponential backoff, 1 minute initial delay)
  • ✅ Comprehensive tests (16 tests, all passing)
  • ✅ Can be disabled via ENABLE_TASK_QUEUE=false environment variable

Data Export Service​

  • ✅ DataExportService with all required methods
  • ✅ DataExport model in Prisma schema
  • ✅ Zero-knowledge encryption using AES-256-GCM with PBKDF2 key derivation (100,000 iterations)
  • ✅ Password never stored server-side
  • ✅ Export data collection gathers all user data (weeks, tasks, training, meals, journal, body composition, etc.)
  • ✅ Exports stored as encrypted files via file storage adapter
  • ✅ Automatic cleanup method for expired exports (configurable retention, default 30 days)
  • ✅ Comprehensive tests (13 service tests, all passing)

Service Methods​

  • ✅ requestExport(userId, password) - Create export job, encrypt with user password
  • ✅ getExportStatus(userId, exportId) - Check export job status
  • ✅ downloadExport(userId, exportId, password) - Download encrypted export (requires password to decrypt)
  • ✅ listExports(userId) - List user's export history
  • ✅ deleteExport(userId, exportId) - Delete export file
  • ✅ cleanupExpiredExports() - Cleanup expired exports

Export Data Collection​

The export includes:

  • User profile and settings (email, theme, defaultCurrency, height, dietaryPreference)
  • Weeks and days
  • Tasks
  • Training sessions, mobility sessions, cardio sessions
  • Meals, meal templates, recipes
  • Grocery lists
  • Journal entries and journal questions
  • Perimeter tasks
  • Exercises
  • Books and reading sessions
  • Body measurements and progress photos

Zero-Knowledge Encryption​

  • ✅ Encrypt export with user-provided password (AES-256-GCM)
  • ✅ Password never stored server-side (only used for encryption)
  • ✅ System cannot decrypt exports (zero-knowledge architecture)
  • ✅ User must provide password to download and decrypt
  • ✅ Security tests verify: wrong password fails, correct password succeeds, password never stored, encrypted data unreadable without password

Export File Storage​

  • ✅ Store encrypted exports in file storage (disk or S3)
  • ✅ Automatic cleanup of old exports (configurable retention, default 30 days)
  • ✅ Secure file access (only user who created export can download)

API Endpoints​

All endpoints are at /api/v1/data-export:

  • ✅ POST /api/v1/data-export/request - Request data export (requires password, min 8 characters)
  • ✅ GET /api/v1/data-export/:exportId/status - Check export status
  • ✅ POST /api/v1/data-export/:exportId/download - Download encrypted export (requires password for decryption)
  • ✅ GET /api/v1/data-export - List user's exports
  • ✅ DELETE /api/v1/data-export/:exportId - Delete export

Frontend UI​

  • ✅ Privacy & Data tab in Settings page with data export section
  • ✅ Request export form with password input and confirmation
  • ✅ Export history list with status display (pending, processing, completed, failed)
  • ✅ Download modal with password input
  • ✅ Delete functionality with confirmation
  • ✅ Clear messaging about zero-knowledge encryption
  • ✅ Auto-refresh for pending/processing exports

Testing​

  • ✅ DataExportService tests (13 tests, all passing) covering:
    • Export creation, encryption, decryption, cleanup
    • Queue processing
    • Security: Zero-knowledge encryption verification
  • ✅ API route tests (10 tests, all passing) covering:
    • Authentication, authorization, password handling
    • All endpoints with validation
  • ✅ E2E tests (6 tests) covering:
    • Complete export workflow
    • Navigation to Privacy & Data tab
    • Zero-knowledge encryption message display
    • Password validation and confirmation
    • Empty state display
    • Export request flow

Security Tests​

The following security tests verify zero-knowledge encryption:

  1. ✅ Wrong password fails to decrypt
  2. ✅ Correct password successfully decrypts
  3. ✅ Password never stored in database
  4. ✅ Encrypted data unreadable without password

Environment Variables​

  • ENABLE_TASK_QUEUE - Enable/disable task queue (default: true)
  • DATA_EXPORT_RETENTION_DAYS - Export retention period in days (default: 30)

Security Architecture​

Zero-Knowledge Design:

  • User provides password only during export request
  • Password passed to background job (temporary, not persisted)
  • Encryption key derived from password using PBKDF2
  • Encrypted file stored (system cannot decrypt without password)
  • Password never stored in database or logs
  • User must provide password again to download and decrypt

File Format:

[salt (16 bytes)][iv (16 bytes)][authTag (16 bytes)][encrypted data]

This ensures that even if the encrypted file is accessed, it cannot be decrypted without the user's password.

Usage​

  1. User navigates to Settings → Privacy & Data tab
  2. User clicks "Create New Export" button
  3. User enters password (min 8 characters) and confirmation
  4. Export job is queued and processed in background
  5. User can check export status (pending → processing → completed)
  6. When completed, user can download export (requires password)
  7. Exports automatically expire after retention period (default 30 days)