---
title: "Privacy & GDPR"
description: "Ring privacy surfaces — granular consent stored on the user record, 30-day account deletion lifecycle with cancellation window, and the member-facing /privacy route"
locale: "en"
---
# Privacy & GDPR

> **Info**
> Use **Founder** / **Developer** tabs in the docs sidebar to filter this page. Members manage their own settings at `/privacy`; this article documents the services behind those surfaces.

Ring gives every clone two concrete privacy surfaces out of the box: **granular consent management** (stored on the user record) and a **scheduled account-deletion lifecycle** with a 30-day window and cancellation. Both are implemented in `features/auth/services/` — no third-party consent SDK required.

| Previous | Ring equivalent |
|----------|-----------------|
| All-or-nothing tracking consent | Four data-sharing toggles + four contact preferences |
| Immediate, irreversible delete | 30-day scheduled deletion with `canCancel` and status lifecycle |
| Consent scattered across vendors | Consent persisted on the `users` record (`data_sharing_consent`) |

## Consent model (verified)

`PrivacyConsent` in `features/auth/types.ts`:

| Group | Fields |
|-------|--------|
| `dataSharingConsent` | `analytics` · `personalization` · `notifications` · `research` |
| `anonymizedResearchConsent` | single boolean |
| `contactPreferences` | `marketing` · `opportunities` · `system` · `evolution` |

`PrivacyConsentService` (`getUserConsent` / `updateUserConsent`) reads and writes these against the user's own record — a member changing consent never leaves the clone.

### For founders

## Why this matters for your clone

- **GDPR-facing clones get a head start.** Consent toggles and erasure requests ship in the codebase; you wire your local legal review on top.
- **Deletion is humane, not instant.** Members request deletion with their password and a reason; the record waits 30 days and can be cancelled — giving people a real reversal window.
- **No vendor lock for privacy.** Consent lives in your database, not a third-party dashboard.

### What to review before go-live

1. Confirm your privacy policy text matches the four consent groups you enable.
2. Decide your deletion window (default 30 days, `scheduledDeletionDate = request + 30`).
3. Run one end-to-end deletion test in staging: request → cancel → request again → confirm.

### For developers

## Service surfaces (verified)

| Module | Role |
|--------|------|
| `features/auth/services/privacy-consent-service.ts` | GDPR-compliant consent read/update on the `users` record |
| `features/auth/services/account-deletion.ts` | Full deletion lifecycle over the `account_deletions` collection |

## Deletion lifecycle

**Request**

`requestAccountDeletion({ userId, password, reason, userEmail, userName })` creates an `account_deletions` record with `status: 'pending'`, `scheduledDeletionDate = now + 30 days`, and `canCancel: true`. A duplicate pending request returns `DELETION_ALREADY_PENDING`.

**Cancel or confirm**

- `cancelAccountDeletion` — member reverses a pending request inside the window.
- `confirmAccountDeletion` — member confirms; processing starts.
- `getAccountDeletionStatus` — read current state for the UI.

**Process**

`processExpiredDeletions()` sweeps expired scheduled deletions through `pending → processing → completed`. Statuses: `pending | cancelled | processing | completed | failed` (failures carry `failureReason`).

## Frequently asked questions

### Impact

#### Do consent changes affect existing notifications?

Consent lives on the user record; notification delivery honors the stored `dataSharingConsent.notifications` preference at read time.

#### Is there a data export surface?

No dedicated export endpoint ships today — deletion and consent are the implemented GDPR surfaces. Flag this to the Ringdom team if export becomes a requirement for your jurisdiction.

### Ops

#### Can I change the 30-day window?

The window is set in `requestAccountDeletion` (`+30` days). Clone owners who need a different window should adjust it in the service and record the change in their compliance docs.

## Related documentation

  
- [features/authentication](/docs/features/authentication.md) — Same-workflow: consent and deletion both operate on the Auth.js user record.

  
- [architecture/security](/docs/architecture/security.md) — See-also: defense-in-depth layers that protect the privacy surfaces.

  
- [features/admin](/docs/features/admin.md) — Next-step: where operators review user records and deletion states.