> ## Documentation Index
> Fetch the complete documentation index at: https://docs.commentify.pro/llms.txt
> Use this file to discover all available pages before exploring further.

# GDPR

> Export, erase, and anonymize IPs for data-subject requests. Default IP retention is 90 days.

Self-hosted does not mean "ignore GDPR". Pro ships Artisan commands so you are not writing SQL at midnight.

## Export

```bash theme={null}
php artisan commentify:gdpr-export user@example.com
```

Writes JSON to the **local** disk under `commentify-gdpr/commentify-gdpr-{sha1}-{timestamp}.json` and prints the absolute path.

The payload includes:

* Comments (including soft-deleted) for that email as `guest_email` **or** matching `users.email` → `user_id`
* Reports and likes for those user ids
* Thread subscriptions for that email / user id
* `exported_at`

Comment export fields: `id`, `body`, `guest_name`, `guest_email`, `ip`, `created_at`.

## Erase

```bash theme={null}
php artisan commentify:gdpr-erase user@example.com --force
```

Without `--force`, confirms first.

**Anonymizes** comments (does not delete the discussion):

* `user_id` → null
* `guest_name` → `Deleted user`
* `guest_email`, `ip`, `user_agent` → null

**Deletes** reports, likes, and subscriptions for that identity. Prints counts.

## Anonymize old IPs

```bash theme={null}
php artisan commentify:gdpr-anonymize-ips --days=90
php artisan commentify:gdpr-anonymize-ips --dry-run
```

Clears `ip` and `user_agent` on comments, likes, and reports older than the window. Default days: `COMMENTIFY_IP_RETENTION_DAYS` / `gdpr.ip_retention_days` (90).

Schedule a weekly anonymize in `routes/console.php` if you want retention without a manual ticket.

Guest likes and reports are IP-keyed; after anonymize, those rows can no longer be tied to a visitor. Plan retention against your legal basis, not just the default.