Implement PostHog PII handling, data retention, and GDPR/CCPA compliance patterns. Use when handling sensitive data, implementing data redaction, configuring retention policies, or ensuring compliance with privacy regulations for PostHog integrations. Trigger with phrases like "posthog data", "posthog PII", "posthog GDPR", "posthog data retention", "posthog privacy", "posthog CCPA".
Use the skills CLI to install this skill with one command. Auto-detects all installed AI assistants.
Method 1 - skills CLI
npx skills i jeremylongshore/claude-code-plugins-plus-skills/plugins/saas-packs/posthog-pack/skills/posthog-data-handlingMethod 2 - openskills (supports sync & update)
npx openskills install jeremylongshore/claude-code-plugins-plus-skillsAuto-detects Claude Code, Cursor, Codex CLI, Gemini CLI, and more. One install, works everywhere.
Installation Path
Download and extract to one of the following locations:
No setup needed. Let our cloud agents run this skill for you.
Select Provider
Select Model
Best for coding tasks
No setup required
Handle sensitive data correctly when integrating with PostHog.
| Category | Examples | Handling |
|---|---|---|
| PII | Email, name, phone | Encrypt, minimize |
| Sensitive | API keys, tokens | Never log, rotate |
| Business | Usage metrics | Aggregate when possible |
| Public | Product names | Standard handling |
const PII_PATTERNS = [
{ type: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
{ type: 'phone', regex: /\b\d{3}[-.]?\d{3}
function redactPII(data: Record<string, any>): Record<string, any> {
const sensitiveFields = ['email', 'phone', 'ssn', 'password', 'apiKey'];
const redacted =
| Data Type | Retention | Reason |
|---|---|---|
| API logs | 30 days | Debugging |
| Error logs | 90 days | Root cause analysis |
| Audit logs | 7 years | Compliance |
| PII | Until deletion request | GDPR/CCPA |
async function cleanupPostHogData(retentionDays: number): Promise<void> {
const cutoff = new Date();
cutoff.setDate(cutoff.getDate() - retentionDays);
await db.posthogLogs.deleteMany({
createdAt: { $lt: cutoff },
type: { $nin: ['audit'
async function exportUserData(userId: string): Promise<DataExport> {
const posthogData = await posthogClient.getUserData(userId);
return {
source: 'PostHog',
exportedAt: new Date().toISOString(),
data: {
profile: posthogData.profile,
async function deleteUserData(userId: string): Promise<DeletionResult> {
// 1. Delete from PostHog
await posthogClient.deleteUser(userId);
// 2. Delete local copies
await db.posthogUserCache.deleteMany({ userId });
// 3. Audit log (required to keep)
await auditLog.record({
action:
// Only request needed fields
const user = await posthogClient.getUser(userId, {
fields: ['id', 'name'], // Not email, phone, address
});
// Don't store unnecessary data
const cacheData = {
id: user.id,
name: user.name,
// Omit sensitive fields
};Categorize all PostHog data by sensitivity level.
Add regex patterns to detect sensitive data in logs.
Apply redaction to sensitive fields before logging.
Configure automatic cleanup with appropriate retention periods.
| Issue | Cause | Solution |
|---|---|---|
| PII in logs | Missing redaction | Wrap logging with redact |
| Deletion failed | Data locked | Check dependencies |
| Export incomplete | Timeout | Increase batch size |
| Audit gap | Missing entries | Review log pipeline |
const findings = detectPII(JSON.stringify(userData));
if (findings.length > 0) {
console.warn(`PII detected: ${findings.map(f => f.type).join(', ')}`);
}const safeData = redactPII(apiResponse);
logger.info('PostHog response:', safeData);const userExport = await exportUserData('user-123');
await sendToUser(userExport);For enterprise access control, see posthog-enterprise-rbac.