Handling user data
Any feature that stores something about a person has to work with account deletion and keep OpenBeacon's privacy promises.
Before adding data
- List every place the data can end up: database rows, storage objects, caches, logs, third-party services and backups.
- Decide who owns each record and how it's removed when an account is deleted.
- Link records to the user, with a fitting deletion rule, wherever you can. A copied name or email address without a user reference can't be reliably found later.
- Include records you create for other people, such as notifications about someone.
- Add tests for deletion and for retrying failed deletion, including writes happening at the same time and the effect on other users.
Uploads
- Keep uploaded files under
user/<userId>/. - Make sure a direct-upload address can't recreate a file after it's been cleaned up.
- If you change how long upload addresses last, change the clean-up delay to match.
- Clean-up must remove object versions and delete markers too.
Groups
Don't delete a group's encryption key just because the person who created it was deleted; other members still need it. Mark the group for a key change instead.
Logs
Never log locations, keys, email addresses, codes or picture addresses.