posthog-data-handling

const PII_PATTERNS = [
  { type: 'email', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g },
  { type: 'phone', regex: /\b\d{3}[-.]?\d{3}

function redactPII(data: Record<string, any>): Record<string, any> {
  const sensitiveFields = ['email', 'phone', 'ssn', 'password', 'apiKey'];
  const redacted =

async function cleanupPostHogData(retentionDays: number): Promise<void> {
  const cutoff = new Date();
  cutoff.setDate(cutoff.getDate() - retentionDays);
 
  await db.posthogLogs.deleteMany({
    createdAt: { $lt: cutoff },
    type: { $nin: ['audit'

async function exportUserData(userId: string): Promise<DataExport> {
  const posthogData = await posthogClient.getUserData(userId);
 
  return {
    source: 'PostHog',
    exportedAt: new Date().toISOString(),
    data: {
      profile: posthogData.profile,

async function deleteUserData(userId: string): Promise<DeletionResult> {
  // 1. Delete from PostHog
  await posthogClient.deleteUser(userId);
 
  // 2. Delete local copies
  await db.posthogUserCache.deleteMany({ userId });
 
  // 3. Audit log (required to keep)
  await auditLog.record({
    action: 

// Only request needed fields
const user = await posthogClient.getUser(userId, {
  fields: ['id', 'name'], // Not email, phone, address
});
 
// Don't store unnecessary data
const cacheData = {
  id: user.id,
  name: user.name,
  // Omit sensitive fields
};

const findings = detectPII(JSON.stringify(userData));
if (findings.length > 0) {
  console.warn(`PII detected: ${findings.map(f => f.type).join(', ')}`);
}

const safeData = redactPII(apiResponse);
logger.info('PostHog response:', safeData);

const userExport = await exportUserData('user-123');
await sendToUser(userExport);