Export

User.export(user_id) returns everything held about the person: their record, every record that belongs to them and the records erasure deletes with those, as JSON, one list per entity, with the same field names as the API. You write nothing for it beyond calling it:

// domains/accounts/actions/export_my_data.jadpo/// Gives the signed-in user a copy of everything held about them./// The route passes the caller in: `run: export_my_data(current_principal.id)`.action export_my_data(user_id: User.id) -> PersonalDataExport {    return User.export(user_id)}

The export covers both the right of access and the right to take your data elsewhere ("portability", Article 20). Credentials, such as token hashes, are left out. It also says how long each kind of data is kept and which companies receive it, taken from the report, because Article 15 asks for that too.

Who may erase and export

Policy decides who may call erase and export. export needs read access to the person's record, and erase needs delete access (Grants). Once a caller is allowed, both reach every record that belongs to the person, as purge does, because a partial export or erasure is worse than none.