#110 — Open Pixel Logs Recipient IP/Timestamps Without Retention or Consent Boundary

[Topmatrixmor2014]

Labels: Official Campaign | FWC26 GrantFox OSS Maybe Rewarded backend privacy gdpr bug

This is a backend issue for the GrantFox FWC26 campaign. Add retention and an explicit consent scope to the tracking-pixel logging path.

Requirements and Context

backend/src/services/emailTrackingService.js — trackingPixelUrl (≈ line 37) and recordEvent (≈ line 50):

• Every email rendered via emailRenderer.render embeds a tracking pixel (/api/emails/track/:emailId/pixel.png) whose GET records the event. The pixel logs the recipient's email-derived ID, IP, user-agent, and timestamp — PII — for every open.
• There is no retention policy on the tracking table; rows accumulate indefinitely (GDPR data-minimization/erasure concern).
• recordEvent is called from sendEmail and processEmailQueue for "sent" and from the pixel for "opened"; the code has no check that the recipient has consented to open-tracking (only email delivery consent is checked via notification_email_preferences).

Objectives

1. Add a retention window (e.g. 90 days) with a cleanup job that deletes old tracking rows, or anonymize IPs (store a hash + truncated IP).
2. Gate open-tracking on an explicit consent flag per recipient (default off), documented in the preference API.
3. Add tests: retention cleanup runs; consent-off recipients are not tracked; isSuppressed still works after cleanup.

Suggested Execution

1. Fork and branch: git checkout -b fix/tracking-retention.
2. Patch emailTrackingService.js + add a cleanup job to backend/src/jobs/ and the cron/scheduler wiring.
3. Add tests; run npm run lint && npm test in backend/.

Acceptance Criteria

• Tracking rows older than the retention window are deleted on schedule.
• Open-tracking is consent-gated (default off).
• ≥4 tests; npm run lint clean.

Guidelines

• Follow the project's existing data-retention patterns (dataRetentionService.js if present); document the policy in the API docs.

Timeframe: 48 hours

[github-actions]

🤖 Greptile AI Context

Greptile has indexed this repository and can provide AI-assisted code review
and context for this issue.

How to use Greptile on this issue:

• Comment @greptileai to ask about relevant code, files, or implementation approaches
• Reference specific files or error messages for targeted analysis
• Use @greptileai explain <file> to get an explanation of any file

Greptile is configured with project-specific rules in .greptile/config.json.

[jchinedu]

let me work on this issue

[grantfox-oss]

🦊 GrantFox — @jchinedu has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #890)
2. Your PR will be reviewed by the FinChippay maintainers

Good luck! Track your progress on GrantFox.