Privacy requests

Families must see the real state of every data request.

Export, deletion, correction and restriction now have a visible request ID, identity gate, data scope, processing state and review boundary. The interface does not pretend that deletion is complete before a real privacy operation can execute it safely.

Request ID · Queue · Receipt

Completed export demo

Export is ready only after processing has actually finished.

Export package is ready for the verified responsible adult. It contains scoped data buckets only.

Request ID: privacy-export-demo
Status: Completed
Receipt: privacy-receipt-privacy-export-demo
External provider: Not invoked

Deletion request demo

Deletion waits for privacy review before irreversible action.

This request is waiting for privacy operations review before any irreversible change is made.

Request ID: privacy-deletion-demo
Status: Submitted For Review
Automatic deletion: Blocked
Reason: Retention Or Safety Hold Review Required

No false success

Queued requests stay visibly queued until a result or error exists.

This protects the demo and future production flow from a common privacy mistake: showing success immediately after a button click while the export package or deletion review has not happened yet.

Queued request: privacy-export-queued-demo
Status: Queued For Processing
Task: privacy-task-privacy-export-queued-demo
Result: Not ready yet

Visible export scope

Families see data buckets, purpose and retention before submission.

Household profile: account lifetime · until deletion review completes
Family matching profile: until revoked · rolling 90/180 day derived snapshots
Consent ledger: account lifetime · legal retention where required
Connections: account lifetime · rolling 180 days for outcomes
Plans: account lifetime · until plan deletion or retention hold
Messages metadata: account lifetime · safety retention where required

Deletion protocol

Active data, indexes, media and processors are separate actions.

Remove active account and household records: Manual Review
Purge discovery, search and recommendation indexes: Manual Review
Withdraw media, files and signed URLs: Manual Review
Notify downstream processors: Manual Review

Workflow steps

The user sees where the request is blocked or moving.

Scope reviewed with family: Complete
Responsible adult identity confirmed: Complete
Server request queued with request ID: Complete
Privacy operations review: Current
Result, error or retention exception shown: Waiting

Readiness gates

What is now covered by the local contract.

Export And Delete Supported: PASS
Deletion Not Automatic: PASS
Privacy Operations Queue: PASS
Privacy Event Outbox: PASS
Export Subject Isolation: PASS
No False Completion: PASS
No Raw Sensitive Export Payload: PASS

Back to privacy settings Review privacy center

Queued requests stay visibly queued until a result or error exists.

This protects the demo and future production flow from a common privacy mistake: showing success immediately after a button click while the export package or deletion review has not happened yet.

Queued request

privacy-export-queued-demo

Status

Queued For Processing

Task

privacy-task-privacy-export-queued-demo

Result

Not ready yet

Families see data buckets, purpose and retention before submission.

Household profile

account lifetime · until deletion review completes

Family matching profile

until revoked · rolling 90/180 day derived snapshots

Consent ledger

account lifetime · legal retention where required

Connections

account lifetime · rolling 180 days for outcomes

Plans

account lifetime · until plan deletion or retention hold

Messages metadata

account lifetime · safety retention where required

Families must see the real state of every data request.

Export is ready only after processing has actually finished.

Deletion waits for privacy review before irreversible action.

Queued requests stay visibly queued until a result or error exists.

Families see data buckets, purpose and retention before submission.

Active data, indexes, media and processors are separate actions.

The user sees where the request is blocked or moving.

What is now covered by the local contract.

How may Huddle remember your choices?

Families must see the real state of every data request.

Export is ready only after processing has actually finished.

Deletion waits for privacy review before irreversible action.

Queued requests stay visibly queued until a result or error exists.

Families see data buckets, purpose and retention before submission.

Active data, indexes, media and processors are separate actions.

The user sees where the request is blocked or moving.

What is now covered by the local contract.