# Export

**Not built.** This page is the design; Jadpo doesn't do this yet. See [What is built](/docs/personal-data-built.md).

`User.export(user_id)` returns everything held about the person: their
record, every record that belongs to them and the records erasure deletes
with those, as JSON, one list per entity, with the same field names as the
API. You write nothing for it
beyond calling it:

```jadpo
// domains/accounts/actions/export_my_data.jadpo
/// Gives the signed-in user a copy of everything held about them.
/// The route passes the caller in: `run: export_my_data(current_principal.id)`.
action export_my_data(user_id: User.id) -> PersonalDataExport {
    return User.export(user_id)
}
```

The export covers both the right of access and the right to take your
data elsewhere ("portability", Article 20). Credentials, such as token
hashes, are left out. It also says how long each kind of data is kept and
which companies receive it, taken from the report, because Article 15
asks for that too.

## Who may erase and export

[Policy](/docs/policy.md) decides who may call `erase` and `export`.
`export` needs read access to the person's record, and `erase` needs
delete access ([Grants](/docs/grants.md)). Once a caller is allowed,
both reach every record that belongs to the person, as purge does,
because a partial export or erasure is worse than none.